Make the vault the thing you share, and ask a host which one it lives in

The teams screen listed teams that owned vaults, so sharing four servers with two
colleagues meant creating a team, then a vault inside it, then wrapping a key.
Two of those three steps are about a concept nobody arrives wanting. The screen
now lists vaults: naming one creates the membership list that carries it, named
after the vault and owned by you, and members, invitations, roles, hand-over and
key holders all hang off the vault they apply to.

Nothing on the server moved. VaultAccessService still resolves a shared vault
through team_membership and every membership call still names a team id — what
went is the requirement that anybody make one. The split the whole design rests
on is untouched and is still what the screen is built around: adding somebody
authorises the server to serve them, and only a machine holding the key can make
the vault readable. ADR 0009 keeps its decision and gains an addendum recording
which half of it a person is now asked about.

The one place the team resurfaces is a membership list carrying several vaults,
which this screen cannot produce and does not hide: the members section says so,
because "adding somebody here adds them there" is precisely the fact a
vault-shaped screen is in a position to conceal.

Two things left the interface and one arrived. Creating a team is gone, and so is
archiving one — it was only ever possible for a team owning no vaults, and a
screen whose rows are vaults has no row for one, so the button would have been
unreachable or always refused. The endpoint is unchanged and the screen states
the limit instead, since a vault cannot be deleted at all. The exception is a
create whose second call failed: cancelling that form archives the membership
list it left behind, which is a deliberate departure from this client's rule
against tidying up on the user's behalf, made because nothing else can reach it.

What arrived is PUT /api/v1/vaults/{id}. Without it the screen loses its only
editing action, since renaming the team behind a vault is invisible to everybody
who was never shown the team. It is gated on PermissionFlags.Admin — the line
UpdateTeamEndpoint already draws, because a name is what everybody in the vault
sees it called rather than part of its contents — and it renames the owning team
with it when that team carries nothing else, so the row an operator reads and the
name a user says cannot drift apart. The slug never moves, for the reason it does
not move on a team rename. The session edits its cached vault row rather than
replacing it with the response, which deliberately carries no wrapped key.

The host editor now asks which vault a host goes into, beside the name, while
adding and only where there is more than one vault to write to. It is a second
picker rather than the keychain screen's reused, and the two selections are
separate on purpose: that one is a standing preference about where new items go,
this is a field of the host in front of you, and binding both to one selection
would mean a click on the other screen could move a half-typed host. An existing
host is not offered it at all rather than offered it disabled — the two vaults
are encrypted under different keys, so moving an item is a delete and a retype.

That forced a fix worth naming. The group picker was built from the active
vault's groups whatever vault the host was being filed into, so a host put in a
shared vault could be filed under a group only its author can resolve — a
colleague would see it filed under nothing, which is the quietest kind of wrong.
Groups are now kept per vault and the picker follows the vault choice.

Two renames, because the pair they would otherwise have made is a bug farm:
ShellScreen.Vault became Keychain and VaultScreen became KeychainScreen, which is
what the rail has always labelled that screen, leaving Vault for one vault's
contents and Vaults for the vaults themselves. The enum values are unchanged;
NavRail.axaml writes them as x:Static literals.

1536 tests pass, seven more than before. Five are new on the server — the rename
endpoint's success, the team it does and does not take with it, the two refusals
and the empty name — and the client suite gains six and folds four together,
having lost the two about archiving a team.

src/DodoSSH.Api/Features/Teams/TeamLog.cs

@@ -50,6 +50,16 @@ internal static partial class TeamLog
     internal static partial void TeamVaultCreated(
         ILogger logger, Guid vaultId, Guid teamId, Guid actorId);
 
+    /// <remarks>
+    /// The vault and its team, and no names. A vault name is plaintext on this server, which is not a
+    /// reason to copy it into everything a log aggregator keeps for a year.
+    /// </remarks>
+    [LoggerMessage(
+        EventId = 2115,
+        Level = LogLevel.Information,
+        Message = "Renamed vault {VaultId} of team {TeamId}.")]
+    internal static partial void VaultRenamed(ILogger logger, Guid vaultId, Guid? teamId);
+
     [LoggerMessage(
         EventId = 2106,
         Level = LogLevel.Information,

src/DodoSSH.Api/Features/Teams/VaultGrantEndpoints.cs

@@ -50,6 +50,78 @@ internal sealed class ListVaultGrantsEndpoint(
     }
 }
 
+/// <summary>Renames a vault.</summary>
+/// <remarks>
+/// <para>
+/// Admin rather than Write, and the line is the one <c>UpdateTeamEndpoint</c> draws: a name is what
+/// everybody in the vault sees it called, so changing it is an administrative act rather than an edit
+/// to the vault's contents. A member who may add hosts to a shared vault may not rename it out from
+/// under the people who share it.
+/// </para>
+/// <para>
+/// Authenticated rather than Enrolled, unlike everything else about a vault here. A rename touches no
+/// key material and needs none — somebody added to a team before they have finished setting their own
+/// machine up can still be reading this screen — and requiring a published identity key would refuse
+/// them for a reason that has nothing to do with what they are asking.
+/// </para>
+/// </remarks>
+internal sealed class RenameVaultEndpoint(
+    ICurrentUserContext currentUser,
+    IVaultAccessService vaultAccess,
+    VaultGrantService grants)
+    : Endpoint<UpdateVaultRequest, Results<Ok<VaultSummary>, NotFound, ProblemHttpResult>>
+{
+    /// <inheritdoc />
+    public override void Configure()
+    {
+        // PUT, for the reason the team rename is a PUT: one field, always sent whole, and a repeat is
+        // the same vault rather than a second edit.
+        Put("/api/v1/vaults/{vaultId:guid}");
+
+        Policies(Auth.AuthenticatedPolicy);
+
+        Description(b => b
+            .WithName("RenameVault")
+            .WithSummary("Renames a vault.")
+            .WithTags("Vaults"));
+    }
+
+    /// <inheritdoc />
+    public override async Task<Results<Ok<VaultSummary>, NotFound, ProblemHttpResult>> ExecuteAsync(
+        UpdateVaultRequest req,
+        CancellationToken ct)
+    {
+        var user = await currentUser.GetOrProvisionAsync(ct).ConfigureAwait(false);
+        var access = await vaultAccess
+            .ResolveAsync(user.Id, Route<Guid>("vaultId"), ct)
+            .ConfigureAwait(false);
+
+        if (!access.Granted || !access.Permissions.HasFlag(PermissionFlags.Read))
+        {
+            return TypedResults.NotFound();
+        }
+
+        if (!access.Permissions.HasFlag(PermissionFlags.Admin))
+        {
+            return Problems.Coded(
+                StatusCodes.Status403Forbidden,
+                ProblemCodes.Forbidden,
+                "Only an admin or the owner of the team that owns this vault can rename it.");
+        }
+
+        try
+        {
+            return TypedResults.Ok(
+                await grants.RenameVaultAsync(access.Vault!, req, ct).ConfigureAwait(false));
+        }
+        catch (TeamInvalidException exception)
+        {
+            return Problems.Coded(
+                StatusCodes.Status400BadRequest, ProblemCodes.InvalidTeam, exception.Message);
+        }
+    }
+}
+
 /// <summary>Wraps this vault's key to another member.</summary>
 /// <remarks>
 /// The one call in this API whose body the server can neither produce nor check. It stores a sealed

src/DodoSSH.Api/Features/Teams/VaultGrantService.cs

@@ -151,6 +151,71 @@ internal sealed class VaultGrantService(
             : name;
     }
 
+    /// <summary>
+    /// Renames a vault, and the team behind it where that team exists to carry this vault alone.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// <b>The team is renamed with it, and only when it owns nothing else.</b> A vault made from the
+    /// vaults screen gets a team of its own named after it, and that team is not a thing the person who
+    /// made it was ever shown — so a rename that moved the vault's name and left the team's would leave
+    /// the operator, the logs and the database naming it something nobody uses. A team owning several
+    /// vaults is a different situation: it has a name of its own that somebody chose, and renaming one of
+    /// its vaults must not take it.
+    /// </para>
+    /// <para>
+    /// The slug never moves, exactly as <c>UpdateTeamRequest</c> records: it is unique only among live
+    /// teams, so a rename that changed it could take one an archived team is still holding.
+    /// </para>
+    /// </remarks>
+    internal async Task<VaultSummary> RenameVaultAsync(
+        Vault vault,
+        UpdateVaultRequest request,
+        CancellationToken cancellationToken)
+    {
+        var name = RequireVaultName(request.Name);
+
+        vault.Name = name;
+        vault.UpdatedAtUtc = clock.GetUtcNow();
+
+        if (vault.TeamId is { } teamId)
+        {
+            var alone = !await database.Vaults
+                .AnyAsync(
+                    other => other.TeamId == teamId
+                        && other.Id != vault.Id
+                        && other.DeletedAtUtc == null,
+                    cancellationToken)
+                .ConfigureAwait(false);
+
+            if (alone)
+            {
+                var team = await database.Teams
+                    .SingleOrDefaultAsync(t => t.Id == teamId && t.DeletedAtUtc == null, cancellationToken)
+                    .ConfigureAwait(false);
+
+                if (team is not null)
+                {
+                    team.Name = name;
+                }
+            }
+        }
+
+        await database.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+
+        TeamLog.VaultRenamed(logger, vault.Id, vault.TeamId);
+
+        return new VaultSummary(
+            VaultId: vault.Id,
+            Name: name,
+            IsPersonal: vault.OwnerKind == VaultOwnerKind.Personal,
+            TeamId: vault.TeamId,
+            KeyGeneration: (uint)vault.KeyGeneration,
+            Permissions: 0,
+            WrappedVaultKey: null,
+            RekeyRequired: vault.RekeyRequired);
+    }
+
     /// <summary>Lists who can open a vault.</summary>
     internal async Task<VaultGrantsResponse> ListGrantsAsync(
         Vault vault,

src/DodoSSH.Api/Setup/EndpointRegistration.cs

@@ -56,6 +56,7 @@ internal static class EndpointRegistration
             typeof(CreateTeamInvitationEndpoint),
             typeof(RevokeTeamInvitationEndpoint),
             typeof(CreateTeamVaultEndpoint),
+            typeof(RenameVaultEndpoint),
             typeof(ListVaultGrantsEndpoint),
             typeof(IssueVaultGrantEndpoint),
             typeof(RevokeVaultGrantEndpoint),

src/DodoSSH.Client.Android/Views/HostsScreen.axaml

@@ -260,6 +260,28 @@
             </ComboBox.ItemTemplate>
           </ComboBox>
 
+          <!--
+            ◆ WHICH VAULT THIS HOST WILL LIVE IN. Drawn only while adding and only where there is more than
+            one vault that can be written to, exactly as on the desktop — an existing host's vault cannot
+            change, because the two are encrypted under different keys and moving an item is a delete and a
+            retype. Above GROUP rather than below it because it decides what GROUP can offer: a group is an
+            item in one vault, so choosing a vault refills that list with that vault's groups.
+          -->
+          <StackPanel Spacing="6" IsVisible="{Binding ShowsEditorVaultChoice}">
+            <TextBlock Classes="label" Text="VAULT" Margin="0,4,0,0" />
+            <ComboBox ItemsSource="{Binding EditorVaultChoices}"
+                      SelectedItem="{Binding EditorSelectedVault}"
+                      HorizontalAlignment="Stretch" MinHeight="44">
+              <ComboBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                  <TextBlock Classes="mono" FontSize="12" Text="{Binding Display}" />
+                </DataTemplate>
+              </ComboBox.ItemTemplate>
+            </ComboBox>
+            <TextBlock Classes="body"
+                       Text="A host in a shared vault is readable by everybody holding that vault's key, and it cannot be moved out afterwards." />
+          </StackPanel>
+
           <TextBlock Classes="label" Text="GROUP" Margin="0,4,0,0" />
           <ComboBox ItemsSource="{Binding EditorGroupChoices}"
                     SelectedItem="{Binding EditorSelectedGroup}"

src/DodoSSH.Client.Android/Views/MoreScreen.axaml

@@ -48,7 +48,7 @@
           product surface leaked the implementation's word.
         -->
         <Button Classes="row" Command="{Binding ShowScreenCommand}"
-                CommandParameter="{x:Static vm:ShellScreen.Vault}">
+                CommandParameter="{x:Static vm:ShellScreen.Keychain}">
           <Grid ColumnDefinitions="Auto,*,Auto">
             <TextBlock Grid.Column="0" Text="⚿" Foreground="{StaticResource AccentText}" FontSize="14"
                        Width="22" VerticalAlignment="Center" />
@@ -128,22 +128,22 @@
         </Button>
 
         <!--
-          Teams, which the v2 design has no row for — it is a shipped screen the design had no slot for
+          Vaults, which the v2 design has no row for — it is a shipped screen the design had no slot for
           rather than a drawn one with nothing behind it. It is on the phone because an invitation is
           claimed by signing in, and somebody being invited is at least as likely to be holding a phone.
 
-          ◎ rather than a glyph of its own. The desktop rail already draws teams with it, and two heads
-          giving one destination two marks is how a user learns the wrong one.
+          ◎ rather than a glyph of its own. The desktop rail already draws this destination with it, and
+          two heads giving one destination two marks is how a user learns the wrong one.
         -->
         <Button Classes="row" Command="{Binding ShowScreenCommand}"
-                CommandParameter="{x:Static vm:ShellScreen.Team}">
+                CommandParameter="{x:Static vm:ShellScreen.Vaults}">
           <Grid ColumnDefinitions="Auto,*,Auto">
             <TextBlock Grid.Column="0" Text="◎" Foreground="{StaticResource AccentText}" FontSize="14"
                        Width="22" VerticalAlignment="Center" />
             <StackPanel Grid.Column="1" Spacing="2" VerticalAlignment="Center">
-              <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="Teams" />
+              <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="Vaults" />
               <TextBlock Classes="detail" Foreground="{StaticResource TextDim}"
-                         Text="Who shares a keychain with you, and who holds its key." />
+                         Text="Your vaults, who is in each one, and who holds its key." />
             </StackPanel>
             <TextBlock Grid.Column="2" Text="›" Foreground="{StaticResource TextGhost}" FontSize="15"
                        VerticalAlignment="Center" />

src/DodoSSH.Client.Android/Views/PhoneShell.axaml

@@ -121,7 +121,7 @@
         <Panel IsVisible="{Binding IsHostsShowing}">
           <views:HostsScreen DataContext="{Binding Vault}" />
         </Panel>
-        <Panel IsVisible="{Binding IsVaultShowing}">
+        <Panel IsVisible="{Binding IsKeychainShowing}">
           <views:KeychainScreen DataContext="{Binding Vault}" />
         </Panel>
         <!--
@@ -153,11 +153,15 @@
 
         <!--
           The sixth destination behind MORE, and the one v2 never drew — see the comment on the screen
-          itself. Wrapped like its neighbours even though Teams is not nullable: the reason for the wrapper
-          is the data context, not the null. IsTeamShowing is the shell's and Teams is not the shell.
+          itself. Wrapped like its neighbours even though Vaults is not nullable: the reason for the
+          wrapper is the data context, not the null. IsVaultsShowing is the shell's and Vaults is not the
+          shell.
+
+          Vaults, not Vault: this one is the vaults themselves and the people in them, where the other is
+          one vault's contents and is what the hosts and keychain screens draw.
         -->
-        <Panel IsVisible="{Binding IsTeamShowing}">
-          <views:TeamsScreen DataContext="{Binding Teams}" />
+        <Panel IsVisible="{Binding IsVaultsShowing}">
+          <views:VaultsScreen DataContext="{Binding Vaults}" />
         </Panel>
 
         <!--

src/DodoSSH.Client.Android/Views/PhoneShell.axaml.cs

@@ -347,8 +347,8 @@ internal sealed partial class PhoneShell : UserControl
         switch (current.Screen)
         {
             case ShellScreen.Snippets or ShellScreen.Logs or ShellScreen.Transfers
-                or ShellScreen.Buckets or ShellScreen.Preferences or ShellScreen.Team
-                or ShellScreen.Vault:
+                or ShellScreen.Buckets or ShellScreen.Preferences or ShellScreen.Vaults
+                or ShellScreen.Keychain:
                 current.ShowScreenCommand.Execute(ShellScreen.More);
                 e.Handled = true;
                 break;

src/DodoSSH.Client.Android/Views/TeamsScreen.axaml

@@ -1,367 +0,0 @@
-<UserControl xmlns="https://github.com/avaloniaui"
-             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
-             xmlns:views="using:DodoSSH.Client.Android.Views"
-             x:Class="DodoSSH.Client.Android.Views.TeamsScreen"
-             x:DataType="vm:TeamsViewModel"
-             Background="{StaticResource Canvas}">
-
-  <!--
-    TEAMS, under MORE — and the one screen behind that hub the v2 phone design never drew.
-
-    It is the reverse of every other entry in docs/design-import-gaps.md: a shipped screen the design had
-    no slot for, rather than a drawn screen with nothing behind it. It is on the phone because an
-    invitation is claimed by *signing in*, and the person being invited is at least as likely to be
-    holding a phone as sitting at a desktop — a team the server has just put somebody into, visible only
-    on a head they may never have installed, is a membership they cannot see.
-
-    That argument is also why the invited list is drawn here and not treated as an administrator's detail:
-    the people on it are the ones who cannot yet see the team, and the row says out loud that no mail was
-    sent.
-
-    So there is no mock-up to depart from. What this departs from instead is the desktop screen over the
-    same view model, and every difference below is a phone difference rather than a second opinion.
-
-    **The desktop's two columns are one.** A 268-pixel team list beside a members-and-vaults table does
-    not exist at 360dp, so the three lists stack in one scrolling column with the teams at the top. That
-    is the same thing HOSTS does with the desktop's sidebar and its connect column, and for the same
-    reason.
-
-    **Nothing scrolls inside anything.** The desktop caps its members and vaults lists at 240 and 200
-    pixels so the two can sit above each other in one pane. Here every list is sized to its content and
-    the screen's own ScrollViewer does all of the scrolling: a list that scrolls inside a page is a region
-    a thumb has to find the edges of, and three of them on one screen is three ways to get stuck.
-
-    ◆ **SHARE KEY is drawn and nothing that takes something away is.** That is a decision rather than a
-    subset. Wrapping a vault key is the one act on this screen a server cannot perform at all — it needs a
-    machine that already holds the key, and this phone is one — so a teams screen that could only be read
-    would leave the product's central claim undemonstrated on the head most people carry. REMOVE MEMBER,
-    WITHDRAW KEY and REVOKE INVITATION are the other half of that, and each of them acts on the first
-    press: the view model's armed-confirmation state covers archiving a team and handing one over, and
-    those three are not armed by it. The desktop guards them with a tooltip instead, which is a control a
-    touch screen has no way to show. An irreversible revocation under a thumb with its explanation missing
-    is the wrong trade, so all three stay on the desktop — where the sentence beside them is visible.
-    Archiving and hand-over are not drawn either, for a plainer reason: they decide whether a team goes on
-    existing and who controls it, which is not a thing to do while walking.
-
-    **ADD MEMBER is not drawn either**, and it is the operation this screen least needs. It is an address
-    typed into a box, a directory lookup, a role picker, and a paragraph beside it saying what adding
-    somebody did *not* do — and since invitations arrived the ordinary way into a team is one the server
-    claims at sign-in, which is what put this screen on the phone at all. Creating a team is here, because
-    a team is where those invitations are sent from and it is two short fields.
-
-    **The key-holder list under a vault is not drawn.** It is a fourth list, it belongs to the selected
-    vault rather than to the team, and the view model publishes no flag saying whether it has anything in
-    it — so a heading for it would sit over nothing whenever nobody holds a key, which is exactly the
-    empty state this head insists comes from the view model rather than from markup. What the phone can
-    answer about a vault is on the vault's own row: whether *this* machine can open it.
-
-    **↻ and `+` both, because this screen has more reason to re-read than any other.** Nothing here is
-    cached — it is all read from the server on arrival and again at the end of every command — so the one
-    thing a member cannot otherwise see is a change somebody else just made: a vault key wrapped to them
-    from a colleague's desktop, or a team they have this moment been invited into. On the desktop the
-    re-read is leaving the rail and coming back, which is one click. Here it is a trip out to MORE and
-    back, so the button earns its place. It binds to a real command rather than to ShowScreen(Team),
-    which would set Screen to the value it already holds, raise nothing and reload nothing.
-  -->
-
-  <Grid RowDefinitions="Auto,Auto,Auto,*,Auto">
-
-    <!-- ============ header ============ -->
-    <Grid Grid.Row="0" ColumnDefinitions="Auto,*,Auto,Auto" Height="56" Margin="8,0">
-      <Button Grid.Column="0" Classes="icon" Content="←"
-              Command="{Binding $parent[views:PhoneShell].((vm:MainWindowViewModel)DataContext).ShowScreenCommand}"
-              CommandParameter="{x:Static vm:ShellScreen.More}" />
-      <TextBlock Grid.Column="1" Classes="heading" Text="Teams" Margin="4,0" />
-      <Button Grid.Column="2" Classes="icon" Content="↻" Command="{Binding RefreshCommand}"
-              IsEnabled="{Binding !IsBusy}" />
-      <Button Grid.Column="3" Classes="icon accent" Content="+" Command="{Binding NewTeamCommand}"
-              IsEnabled="{Binding !IsBusy}" />
-    </Grid>
-
-    <!-- ============ a new team ============ -->
-    <!--
-      Above the list rather than in place of it, which is the opposite of what the host and snippet
-      editors do — and the difference is what the form is about. Those two edit a row that is on screen,
-      so a card stacked over the list hides the thing being changed. This one is about a team that does
-      not exist yet, and the teams that do are exactly the useful thing to be able to see while naming it:
-      the slug has to be unique on this server, and the near misses are right underneath.
-    -->
-    <Border Grid.Row="1" Classes="card" Margin="12,0,12,8" IsVisible="{Binding IsCreatingTeam}">
-      <StackPanel Spacing="10">
-        <TextBlock Classes="label" Text="NEW TEAM" />
-
-        <TextBox Classes="field" Text="{Binding NewTeamName}" PlaceholderText="name" />
-        <TextBox Classes="field" Text="{Binding NewTeamSlug}" PlaceholderText="slug-for-urls" />
-
-        <TextBlock Classes="body"
-                   Text="The slug is lowercase letters, digits and hyphens, and has to be unique across this server. It is fixed once the team exists — a team can be renamed and its slug cannot." />
-
-        <Grid ColumnDefinitions="*,8,*">
-          <Button Grid.Column="0" Classes="primary" Height="44" Content="CREATE"
-                  Command="{Binding CreateTeamCommand}" IsEnabled="{Binding !IsBusy}" />
-          <Button Grid.Column="2" Classes="secondary" Height="44" Content="CANCEL"
-                  Command="{Binding CancelNewTeamCommand}" />
-        </Grid>
-      </StackPanel>
-    </Border>
-
-    <!--
-      Status, and it is the empty state as well: the view model writes "you are not in a team yet" into
-      the same property it writes an offline notice and every command's outcome into. A literal here would
-      be a second voice saying the same thing slightly differently.
-    -->
-    <TextBlock Grid.Row="2" Classes="detail" Margin="18,2,18,6" TextWrapping="Wrap"
-               Text="{Binding Status}"
-               IsVisible="{Binding Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
-
-    <!-- ============ the column ============ -->
-    <ScrollViewer Grid.Row="3">
-      <StackPanel Margin="0,0,0,18">
-
-        <TextBlock Classes="section" Text="TEAMS" Margin="18,4,18,4" />
-
-        <!--
-          Rows as cards, filled when chosen, which is what HOSTS settled on in v2 and what the radius
-          ladder calls a card: one item, one rule, one thing you act on. The fill is on the item rather
-          than on a Border inside it so the rounding the theme draws for selection is the row's own.
-        -->
-        <ListBox ItemsSource="{Binding Teams}" SelectedItem="{Binding SelectedTeam}"
-                 IsVisible="{Binding HasTeams}" Background="Transparent" BorderThickness="0">
-          <ListBox.Styles>
-            <Style Selector="ListBoxItem">
-              <Setter Property="Padding" Value="0" />
-              <Setter Property="MinHeight" Value="0" />
-              <Setter Property="Margin" Value="10,1" />
-              <Setter Property="CornerRadius" Value="12" />
-            </Style>
-            <Style Selector="ListBoxItem:selected /template/ ContentPresenter">
-              <Setter Property="Background" Value="{StaticResource Active}" />
-              <Setter Property="CornerRadius" Value="12" />
-            </Style>
-          </ListBox.Styles>
-          <ListBox.ItemTemplate>
-            <DataTemplate x:DataType="vm:TeamRowViewModel">
-              <Grid ColumnDefinitions="*,Auto" MinHeight="54" Margin="14,11">
-                <StackPanel Grid.Column="0" Spacing="3" VerticalAlignment="Center">
-                  <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="{Binding Name}"
-                             TextTrimming="CharacterEllipsis" />
-                  <TextBlock Classes="detail" FontSize="10.5" Text="{Binding Detail}" />
-                </StackPanel>
-
-                <!-- The caller's own role in this team, which is what says why some of it is read-only. -->
-                <Border Grid.Column="1" Classes="tag outline" Margin="8,0,0,0">
-                  <TextBlock Text="{Binding Role}" />
-                </Border>
-              </Grid>
-            </DataTemplate>
-          </ListBox.ItemTemplate>
-        </ListBox>
-
-        <!-- ============ the chosen team ============ -->
-        <StackPanel IsVisible="{Binding HasSelection}">
-
-          <TextBlock Classes="section" Text="MEMBERS" Margin="18,18,18,4" />
-
-          <ListBox ItemsSource="{Binding Members}" SelectedItem="{Binding SelectedMember}"
-                   Background="Transparent" BorderThickness="0">
-            <ListBox.Styles>
-              <Style Selector="ListBoxItem">
-                <Setter Property="Padding" Value="0" />
-                <Setter Property="MinHeight" Value="0" />
-                <Setter Property="Margin" Value="10,1" />
-                <Setter Property="CornerRadius" Value="12" />
-              </Style>
-              <Style Selector="ListBoxItem:selected /template/ ContentPresenter">
-                <Setter Property="Background" Value="{StaticResource Active}" />
-                <Setter Property="CornerRadius" Value="12" />
-              </Style>
-            </ListBox.Styles>
-            <ListBox.ItemTemplate>
-              <DataTemplate x:DataType="vm:TeamMemberRowViewModel">
-                <Grid ColumnDefinitions="*,Auto" MinHeight="54" Margin="14,11">
-                  <StackPanel Grid.Column="0" Spacing="3" VerticalAlignment="Center">
-                    <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="{Binding Name}"
-                               TextTrimming="CharacterEllipsis" />
-                    <TextBlock Classes="detail" FontSize="10.5" Text="{Binding Email}"
-                               TextTrimming="CharacterEllipsis" />
-
-                    <!--
-                      ◆ The one fact on this row that decides whether the button at the foot of the screen
-                      can do anything: an account with no published identity key has nothing for a vault
-                      key to be wrapped to. One sentence, from the view model, painted twice rather than
-                      written twice — the warning colour is the whole of the difference, and a converter
-                      for it would hide that the two are the same string.
-
-                      The published case is quiet rather than green. Green on this head means a shell is
-                      open right now, and a published key is a durable fact about an account — borrowing
-                      the status colour for it would be the second meaning that makes the first
-                      unreadable. Only the missing key is coloured, because only it needs answering.
-                    -->
-                    <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
-                               Foreground="{StaticResource TextDim}" Text="{Binding KeyState}"
-                               IsVisible="{Binding Member.IsEnrolled}" />
-                    <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
-                               Foreground="{StaticResource WarnText}" Text="{Binding KeyState}"
-                               IsVisible="{Binding !Member.IsEnrolled}" />
-
-                    <!--
-                      A date to the day, or that they have never been here at all. The view model writes
-                      both, and neither is a guess: the server records the account's last authenticated
-                      request at most once an hour, which is what makes a day the honest unit.
-                    -->
-                    <TextBlock Classes="detail" FontSize="9.5" Foreground="{StaticResource TextFaint}"
-                               Text="{Binding LastActive}" />
-                  </StackPanel>
-
-                  <Border Grid.Column="1" Classes="tag outline" Margin="8,0,0,0">
-                    <TextBlock Text="{Binding Role}" />
-                  </Border>
-                </Grid>
-              </DataTemplate>
-            </ListBox.ItemTemplate>
-          </ListBox>
-
-          <TextBlock Classes="body" Margin="18,10,18,0"
-                     Text="Being in a team is what lets the server hand somebody this team's vaults. It is not what lets them read one: a vault key can only be wrapped by a machine that already holds it, which is what sharing below does." />
-
-          <!-- ============ ◆ who has been asked and has not arrived ============ -->
-          <!--
-            The section this screen exists for, and the one the desktop had nothing to draw until
-            invitations were built. Read-only here: withdrawing one is a control that acts on the first
-            press, which is the line drawn at the top of this file.
-
-            So these are cards rather than the flat rows above them, and the shape is the difference: a row
-            that fills when you touch it is one of several you are choosing between, and there is nothing
-            to choose here. An ItemsControl rather than a ListBox for the same reason — a list with a
-            selection nothing reads would be a control offering something it cannot do.
-
-            Gated on the view model's own count rather than left to stand over an empty list, because a
-            team with nobody outstanding is the ordinary case and a permanent empty heading would make it
-            look like a section that had failed to load.
-
-            The waiting row carries the whole mechanism in its own sentence — no mail was sent, and they
-            join when they first sign in here. That is the sentence somebody has to read, because every
-            other product's version of this word means an email is on its way.
-          -->
-          <StackPanel IsVisible="{Binding HasInvitations}">
-            <TextBlock Classes="section" Text="INVITED" Margin="18,18,18,4" />
-
-            <ItemsControl ItemsSource="{Binding Invitations}">
-              <ItemsControl.ItemTemplate>
-                <DataTemplate x:DataType="vm:TeamInvitationRowViewModel">
-                  <Border Classes="card" Margin="12,3">
-                    <Grid ColumnDefinitions="*,Auto">
-                      <StackPanel Grid.Column="0" Spacing="3" VerticalAlignment="Center">
-                        <TextBlock Classes="mono" FontSize="12.5" Text="{Binding Email}"
-                                   TextTrimming="CharacterEllipsis" />
-                        <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
-                                   Foreground="{StaticResource TextDim}" Text="{Binding State}"
-                                   IsVisible="{Binding !IsPending}" />
-                        <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
-                                   Foreground="{StaticResource WarnText}" Text="{Binding State}"
-                                   IsVisible="{Binding IsPending}" />
-                      </StackPanel>
-                      <Border Grid.Column="1" Classes="tag outline" Margin="8,0,0,0">
-                        <TextBlock Text="{Binding Role}" />
-                      </Border>
-                    </Grid>
-                  </Border>
-                </DataTemplate>
-              </ItemsControl.ItemTemplate>
-            </ItemsControl>
-          </StackPanel>
-
-          <TextBlock Classes="section" Text="VAULTS" Margin="18,18,18,4" />
-
-          <ListBox ItemsSource="{Binding Vaults}" SelectedItem="{Binding SelectedVault}"
-                   Background="Transparent" BorderThickness="0">
-            <ListBox.Styles>
-              <Style Selector="ListBoxItem">
-                <Setter Property="Padding" Value="0" />
-                <Setter Property="MinHeight" Value="0" />
-                <Setter Property="Margin" Value="10,1" />
-                <Setter Property="CornerRadius" Value="12" />
-              </Style>
-              <Style Selector="ListBoxItem:selected /template/ ContentPresenter">
-                <Setter Property="Background" Value="{StaticResource Active}" />
-                <Setter Property="CornerRadius" Value="12" />
-              </Style>
-            </ListBox.Styles>
-            <ListBox.ItemTemplate>
-              <DataTemplate x:DataType="vm:TeamVaultRowViewModel">
-                <StackPanel Spacing="3" MinHeight="54" Margin="14,11" VerticalAlignment="Center">
-                  <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="{Binding Name}"
-                             TextTrimming="CharacterEllipsis" />
-
-                  <!--
-                    Whether *this* phone can open it, which is a property of its keyring rather than
-                    anything the server could answer. Painted the same two ways as the member's key
-                    state above, because it is the same question asked from the other end.
-                  -->
-                  <TextBlock Classes="detail" FontSize="10.5" TextWrapping="Wrap"
-                             Foreground="{StaticResource TextDim}" Text="{Binding State}"
-                             IsVisible="{Binding IsReadable}" />
-                  <TextBlock Classes="detail" FontSize="10.5" TextWrapping="Wrap"
-                             Foreground="{StaticResource WarnText}" Text="{Binding State}"
-                             IsVisible="{Binding !IsReadable}" />
-                </StackPanel>
-              </DataTemplate>
-            </ListBox.ItemTemplate>
-          </ListBox>
-
-          <TextBlock Classes="body" Margin="18,10,18,0"
-                     Text="A vault listed here that this phone has no key to stays listed and stays shut. That is the ordinary case rather than a fault: somebody has been added to the team and nobody has wrapped the key to them yet." />
-
-        </StackPanel>
-
-      </StackPanel>
-    </ScrollViewer>
-
-    <!-- ============ ◆ giving somebody the key ============ -->
-    <!--
-      Raised over the column when both halves of the act have been chosen, as HOSTS raises its connect bar
-      and SNIPPETS its insert bar, and for the reason written there: there is no second column to put it
-      in, so it names what it will do rather than relying on a selection being visible beside the button.
-
-      Two wrappers rather than one condition. Sharing needs a member *and* a vault, and a binding cannot
-      say `SelectedMember is not null && SelectedVault is not null` without a converter that does not
-      exist — the log screen makes the same trade for the same reason. It also gets the halves in the
-      right order: choosing who comes first, and until a vault is chosen there is nothing to offer them.
-    -->
-    <Panel Grid.Row="4" IsVisible="{Binding SelectedMember, Converter={x:Static ObjectConverters.IsNotNull}}">
-      <Border IsVisible="{Binding SelectedVault, Converter={x:Static ObjectConverters.IsNotNull}}"
-              Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
-              BorderThickness="0,1,0,0" Padding="14,12">
-        <StackPanel Spacing="9">
-
-          <StackPanel Orientation="Horizontal" Spacing="8">
-            <TextBlock Classes="label" Text="THE KEY TO" />
-            <TextBlock Classes="mono" FontSize="11" Text="{Binding SelectedVault.Name}"
-                       TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-          </StackPanel>
-
-          <StackPanel Orientation="Horizontal" Spacing="8">
-            <TextBlock Classes="label" Text="FOR" />
-            <TextBlock Classes="mono" FontSize="11" Text="{Binding SelectedMember.Name}"
-                       TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
-          </StackPanel>
-
-          <Button Classes="primary" Content="SHARE KEY" Command="{Binding ShareVaultCommand}"
-                  IsEnabled="{Binding !IsBusy}" />
-
-          <!--
-            The sentence the desktop hangs off a tooltip, which a phone cannot show — so it is body text
-            under the button, where it is read before the tap rather than after it. It is not decoration:
-            the key-log check proves this server has been consistent with itself and nothing more.
-          -->
-          <TextBlock Classes="body"
-                     Text="Their published key is checked against the server's append-only key log first, and nothing is wrapped if it does not appear there unchanged. That proves the server has been consistent with itself — not that the key is the right person's. Compare the fingerprint with them over a channel this server does not carry before sharing anything that matters." />
-
-        </StackPanel>
-      </Border>
-    </Panel>
-
-  </Grid>
-
-</UserControl>

src/DodoSSH.Client.Android/Views/TeamsScreen.axaml.cs

@@ -1,10 +0,0 @@
-using Avalonia.Controls;
-using Avalonia.Markup.Xaml;
-
-namespace DodoSSH.Client.Android.Views;
-
-/// <summary>Teams, under MORE — who is in one, and which of its vaults this phone can open.</summary>
-internal sealed partial class TeamsScreen : UserControl
-{
-    public TeamsScreen() => AvaloniaXamlLoader.Load(this);
-}

src/DodoSSH.Client.Android/Views/VaultsScreen.axaml

@@ -0,0 +1,347 @@
+<UserControl xmlns="https://github.com/avaloniaui"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
+             xmlns:views="using:DodoSSH.Client.Android.Views"
+             x:Class="DodoSSH.Client.Android.Views.VaultsScreen"
+             x:DataType="vm:VaultsViewModel"
+             Background="{StaticResource Canvas}">
+
+  <!--
+    VAULTS, under MORE — and the one screen behind that hub the v2 phone design never drew.
+
+    It is the reverse of every other entry in docs/design-import-gaps.md: a shipped screen the design had
+    no slot for, rather than a drawn screen with nothing behind it. It is on the phone because an
+    invitation is claimed by *signing in*, and the person being invited is at least as likely to be
+    holding a phone as sitting at a desktop — a vault the server has just put somebody into, visible only
+    on a head they may never have installed, is a membership they cannot see.
+
+    That argument is also why the invited list is drawn here and not treated as an administrator's detail:
+    the people on it are the ones who cannot yet see the vault, and the row says out loud that no mail was
+    sent.
+
+    ── IT LISTED TEAMS UNTIL THE SCREEN STOPPED BEING ABOUT THEM. ───────────────────────────────────────
+    The rows are vaults now, and the members under one are the people that vault is shared with. Nothing
+    about the server changed — it still authorises through a team — and what went is the step where
+    somebody had to make one before they could share anything. See VaultsViewModel.
+
+    So there is no mock-up to depart from. What this departs from instead is the desktop screen over the
+    same view model, and every difference below is a phone difference rather than a second opinion.
+
+    **The desktop's two columns are one.** A 268-pixel vault list beside a members table does not exist at
+    360dp, so the lists stack in one scrolling column with the vaults at the top. That is the same thing
+    HOSTS does with the desktop's sidebar and its connect column, and for the same reason.
+
+    **Nothing scrolls inside anything.** The desktop caps its members list at 240 pixels so several can sit
+    above each other in one pane. Here every list is sized to its content and the screen's own ScrollViewer
+    does all of the scrolling: a list that scrolls inside a page is a region a thumb has to find the edges
+    of, and three of them on one screen is three ways to get stuck.
+
+    ◆ **SHARE KEY is drawn and nothing that takes something away is.** That is a decision rather than a
+    subset. Wrapping a vault key is the one act on this screen a server cannot perform at all — it needs a
+    machine that already holds the key, and this phone is one — so a vaults screen that could only be read
+    would leave the product's central claim undemonstrated on the head most people carry. REMOVE, WITHDRAW
+    KEY and WITHDRAW INVITATION are the other half of that, and each of them acts on the first press: the
+    view model's armed-confirmation state covers handing a vault over and nothing else. The desktop guards
+    them with a tooltip instead, which is a control a touch screen has no way to show. An irreversible
+    revocation under a thumb with its explanation missing is the wrong trade, so all three stay on the
+    desktop — where the sentence beside them is visible. Handing a vault over is not drawn either, for a
+    plainer reason: it decides who controls the vault, which is not a thing to do while walking. Nor is
+    renaming, which is a keyboard on a screen that is otherwise all reading.
+
+    **ADD is not drawn either**, and it is the operation this screen least needs. It is an address typed
+    into a box, a directory lookup, a role picker, and a paragraph beside it saying what adding somebody
+    did *not* do — and since invitations arrived the ordinary way into a vault is one the server claims at
+    sign-in, which is what put this screen on the phone at all. Making a vault is here, because it is one
+    field and because it is what a person carrying a phone can usefully start.
+
+    **The key-holder list is not drawn.** It is a third list, and what the phone can answer about a vault
+    is the more useful half of the same question and is on the vault's own row: whether *this* machine can
+    open it.
+
+    **↻ and `+` both, because this screen has more reason to re-read than any other.** Who is in a vault is
+    not cached — it is read from the server on arrival and again at the end of every command — so the one
+    thing a member cannot otherwise see is a change somebody else just made: a vault key wrapped to them
+    from a colleague's desktop, or a vault they have this moment been invited into. On the desktop the
+    re-read is leaving the rail and coming back, which is one click. Here it is a trip out to MORE and
+    back, so the button earns its place. It binds to a real command rather than to ShowScreen(Vaults),
+    which would set Screen to the value it already holds, raise nothing and reload nothing.
+  -->
+
+  <Grid RowDefinitions="Auto,Auto,Auto,*,Auto">
+
+    <!-- ============ header ============ -->
+    <Grid Grid.Row="0" ColumnDefinitions="Auto,*,Auto,Auto" Height="56" Margin="8,0">
+      <Button Grid.Column="0" Classes="icon" Content="←"
+              Command="{Binding $parent[views:PhoneShell].((vm:MainWindowViewModel)DataContext).ShowScreenCommand}"
+              CommandParameter="{x:Static vm:ShellScreen.More}" />
+      <TextBlock Grid.Column="1" Classes="heading" Text="Vaults" Margin="4,0" />
+      <Button Grid.Column="2" Classes="icon" Content="↻" Command="{Binding RefreshCommand}"
+              IsEnabled="{Binding !IsBusy}" />
+      <Button Grid.Column="3" Classes="icon accent" Content="+" Command="{Binding NewVaultCommand}"
+              IsEnabled="{Binding !IsBusy}" />
+    </Grid>
+
+    <!-- ============ a new vault ============ -->
+    <!--
+      Above the list rather than in place of it, which is the opposite of what the host and snippet
+      editors do — and the difference is what the form is about. Those two edit a row that is on screen,
+      so a card stacked over the list hides the thing being changed. This one is about a vault that does
+      not exist yet, and the vaults that do are exactly the useful thing to be able to see while naming it.
+    -->
+    <Border Grid.Row="1" Classes="card" Margin="12,0,12,8" IsVisible="{Binding IsCreatingVault}">
+      <StackPanel Spacing="10">
+        <TextBlock Classes="label" Text="NEW VAULT" />
+
+        <TextBox Classes="field" Text="{Binding NewVaultName}" PlaceholderText="name" />
+
+        <TextBlock Classes="body"
+                   Text="Its key is made on this phone and nobody else has it. Add people to it once it exists, then share the key with them." />
+
+        <Grid ColumnDefinitions="*,8,*">
+          <Button Grid.Column="0" Classes="primary" Height="44" Content="CREATE"
+                  Command="{Binding CreateVaultCommand}" IsEnabled="{Binding !IsBusy}" />
+          <Button Grid.Column="2" Classes="secondary" Height="44" Content="CANCEL"
+                  Command="{Binding CancelNewVaultCommand}" />
+        </Grid>
+      </StackPanel>
+    </Border>
+
+    <!--
+      Status, and it is the empty state as well: the view model writes "locked" and every command's
+      outcome into the same property. A literal here would be a second voice saying the same thing
+      slightly differently.
+    -->
+    <TextBlock Grid.Row="2" Classes="detail" Margin="18,2,18,6" TextWrapping="Wrap"
+               Text="{Binding Status}"
+               IsVisible="{Binding Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}" />
+
+    <!-- ============ the column ============ -->
+    <ScrollViewer Grid.Row="3">
+      <StackPanel Margin="0,0,0,18">
+
+        <TextBlock Classes="section" Text="VAULTS" Margin="18,4,18,4" />
+
+        <!--
+          Rows as cards, filled when chosen, which is what HOSTS settled on in v2 and what the radius
+          ladder calls a card: one item, one rule, one thing you act on. The fill is on the item rather
+          than on a Border inside it so the rounding the theme draws for selection is the row's own.
+        -->
+        <ListBox ItemsSource="{Binding Vaults}" SelectedItem="{Binding SelectedVault}"
+                 IsVisible="{Binding HasVaults}" Background="Transparent" BorderThickness="0">
+          <ListBox.Styles>
+            <Style Selector="ListBoxItem">
+              <Setter Property="Padding" Value="0" />
+              <Setter Property="MinHeight" Value="0" />
+              <Setter Property="Margin" Value="10,1" />
+              <Setter Property="CornerRadius" Value="12" />
+            </Style>
+            <Style Selector="ListBoxItem:selected /template/ ContentPresenter">
+              <Setter Property="Background" Value="{StaticResource Active}" />
+              <Setter Property="CornerRadius" Value="12" />
+            </Style>
+          </ListBox.Styles>
+          <ListBox.ItemTemplate>
+            <DataTemplate x:DataType="vm:VaultRowViewModel">
+              <Grid ColumnDefinitions="*,Auto" MinHeight="54" Margin="14,11">
+                <StackPanel Grid.Column="0" Spacing="3" VerticalAlignment="Center">
+                  <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="{Binding Name}"
+                             TextTrimming="CharacterEllipsis" />
+                  <TextBlock Classes="detail" FontSize="10.5" Text="{Binding Detail}" />
+
+                  <!--
+                    Whether *this* phone can open it, and whether a rekey is owed. Coloured because both
+                    states need somebody to act; drawn at all only when there is one, so an ordinary vault
+                    carries no line rather than a reassurance nobody reads.
+                  -->
+                  <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
+                             Foreground="{StaticResource WarnText}" Text="{Binding State}"
+                             IsVisible="{Binding HasState}" />
+                </StackPanel>
+
+                <!-- The caller's own role here, which is what says why some of it is read-only. -->
+                <Border Grid.Column="1" Classes="tag outline" Margin="8,0,0,0">
+                  <TextBlock Text="{Binding RoleLabel}" />
+                </Border>
+              </Grid>
+            </DataTemplate>
+          </ListBox.ItemTemplate>
+        </ListBox>
+
+        <!-- ============ the chosen vault ============ -->
+        <StackPanel IsVisible="{Binding HasSelection}">
+
+          <!--
+            The personal vault has no members and never will, so the members heading is gated on the vault
+            being one that can have them rather than left standing over an empty list.
+          -->
+          <TextBlock Classes="body" Margin="18,18,18,0" IsVisible="{Binding SelectedIsPersonal}"
+                     Text="Nobody can be added to your personal vault, and the server refuses a key grant on one outright. Make a vault for the things you want to share, and put them in it." />
+
+          <StackPanel IsVisible="{Binding SelectedIsShared}">
+
+            <TextBlock Classes="section" Text="MEMBERS" Margin="18,18,18,4" />
+
+            <TextBlock Classes="body" Margin="18,0,18,4" IsVisible="{Binding HasSharedMembershipWarning}"
+                       Text="{Binding SharedMembershipWarning}" />
+
+            <ListBox ItemsSource="{Binding Members}" SelectedItem="{Binding SelectedMember}"
+                     Background="Transparent" BorderThickness="0">
+              <ListBox.Styles>
+                <Style Selector="ListBoxItem">
+                  <Setter Property="Padding" Value="0" />
+                  <Setter Property="MinHeight" Value="0" />
+                  <Setter Property="Margin" Value="10,1" />
+                  <Setter Property="CornerRadius" Value="12" />
+                </Style>
+                <Style Selector="ListBoxItem:selected /template/ ContentPresenter">
+                  <Setter Property="Background" Value="{StaticResource Active}" />
+                  <Setter Property="CornerRadius" Value="12" />
+                </Style>
+              </ListBox.Styles>
+              <ListBox.ItemTemplate>
+                <DataTemplate x:DataType="vm:VaultMemberRowViewModel">
+                  <Grid ColumnDefinitions="*,Auto" MinHeight="54" Margin="14,11">
+                    <StackPanel Grid.Column="0" Spacing="3" VerticalAlignment="Center">
+                      <TextBlock Classes="mono" FontSize="13.5" FontWeight="SemiBold" Text="{Binding Name}"
+                                 TextTrimming="CharacterEllipsis" />
+                      <TextBlock Classes="detail" FontSize="10.5" Text="{Binding Email}"
+                                 TextTrimming="CharacterEllipsis" />
+
+                      <!--
+                        ◆ The one fact on this row that decides whether the button at the foot of the screen
+                        can do anything: an account with no published identity key has nothing for a vault
+                        key to be wrapped to. One sentence, from the view model, painted twice rather than
+                        written twice — the warning colour is the whole of the difference, and a converter
+                        for it would hide that the two are the same string.
+
+                        The published case is quiet rather than green. Green on this head means a shell is
+                        open right now, and a published key is a durable fact about an account — borrowing
+                        the status colour for it would be the second meaning that makes the first
+                        unreadable. Only the missing key is coloured, because only it needs answering.
+                      -->
+                      <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
+                                 Foreground="{StaticResource TextDim}" Text="{Binding KeyState}"
+                                 IsVisible="{Binding Member.IsEnrolled}" />
+                      <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
+                                 Foreground="{StaticResource WarnText}" Text="{Binding KeyState}"
+                                 IsVisible="{Binding !Member.IsEnrolled}" />
+
+                      <!--
+                        A date to the day, or that they have never been here at all. The view model writes
+                        both, and neither is a guess: the server records the account's last authenticated
+                        request at most once an hour, which is what makes a day the honest unit.
+                      -->
+                      <TextBlock Classes="detail" FontSize="9.5" Foreground="{StaticResource TextFaint}"
+                                 Text="{Binding LastActive}" />
+                    </StackPanel>
+
+                    <Border Grid.Column="1" Classes="tag outline" Margin="8,0,0,0">
+                      <TextBlock Text="{Binding Role}" />
+                    </Border>
+                  </Grid>
+                </DataTemplate>
+              </ListBox.ItemTemplate>
+            </ListBox>
+
+            <TextBlock Classes="body" Margin="18,10,18,0"
+                       Text="Being in a vault is what lets the server hand somebody its rows. It is not what lets them read one: a vault key can only be wrapped by a machine that already holds it, which is what sharing below does." />
+
+            <!-- ============ ◆ who has been asked and has not arrived ============ -->
+            <!--
+              The section this screen exists for, and the one the desktop had nothing to draw until
+              invitations were built. Read-only here: withdrawing one is a control that acts on the first
+              press, which is the line drawn at the top of this file.
+
+              So these are cards rather than the flat rows above them, and the shape is the difference: a
+              row that fills when you touch it is one of several you are choosing between, and there is
+              nothing to choose here. An ItemsControl rather than a ListBox for the same reason — a list
+              with a selection nothing reads would be a control offering something it cannot do.
+
+              Gated on the view model's own count rather than left to stand over an empty list, because a
+              vault with nobody outstanding is the ordinary case and a permanent empty heading would make
+              it look like a section that had failed to load.
+
+              The waiting row carries the whole mechanism in its own sentence — no mail was sent, and they
+              join when they first sign in here. That is the sentence somebody has to read, because every
+              other product's version of this word means an email is on its way.
+            -->
+            <StackPanel IsVisible="{Binding HasInvitations}">
+              <TextBlock Classes="section" Text="INVITED" Margin="18,18,18,4" />
+
+              <ItemsControl ItemsSource="{Binding Invitations}">
+                <ItemsControl.ItemTemplate>
+                  <DataTemplate x:DataType="vm:VaultInvitationRowViewModel">
+                    <Border Classes="card" Margin="12,3">
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0" Spacing="3" VerticalAlignment="Center">
+                          <TextBlock Classes="mono" FontSize="12.5" Text="{Binding Email}"
+                                     TextTrimming="CharacterEllipsis" />
+                          <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
+                                     Foreground="{StaticResource TextDim}" Text="{Binding State}"
+                                     IsVisible="{Binding !IsPending}" />
+                          <TextBlock Classes="detail" FontSize="10" TextWrapping="Wrap"
+                                     Foreground="{StaticResource WarnText}" Text="{Binding State}"
+                                     IsVisible="{Binding IsPending}" />
+                        </StackPanel>
+                        <Border Grid.Column="1" Classes="tag outline" Margin="8,0,0,0">
+                          <TextBlock Text="{Binding Role}" />
+                        </Border>
+                      </Grid>
+                    </Border>
+                  </DataTemplate>
+                </ItemsControl.ItemTemplate>
+              </ItemsControl>
+            </StackPanel>
+
+          </StackPanel>
+
+        </StackPanel>
+
+      </StackPanel>
+    </ScrollViewer>
+
+    <!-- ============ ◆ giving somebody the key ============ -->
+    <!--
+      Raised over the column when somebody has been chosen, as HOSTS raises its connect bar and SNIPPETS
+      its insert bar, and for the reason written there: there is no second column to put it in, so it names
+      what it will do rather than relying on a selection being visible beside the button.
+
+      One condition where there used to be two. Sharing needs a member and a vault, and the vault is now
+      the thing the whole screen is about — a member can only be selected under one, so choosing who is the
+      only half left to make.
+    -->
+    <Border Grid.Row="4"
+            IsVisible="{Binding SelectedMember, Converter={x:Static ObjectConverters.IsNotNull}}"
+            Background="{StaticResource Chrome}" BorderBrush="{StaticResource Border}"
+            BorderThickness="0,1,0,0" Padding="14,12">
+      <StackPanel Spacing="9">
+
+        <StackPanel Orientation="Horizontal" Spacing="8">
+          <TextBlock Classes="label" Text="THE KEY TO" />
+          <TextBlock Classes="mono" FontSize="11" Text="{Binding SelectedVault.Name}"
+                     TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
+        </StackPanel>
+
+        <StackPanel Orientation="Horizontal" Spacing="8">
+          <TextBlock Classes="label" Text="FOR" />
+          <TextBlock Classes="mono" FontSize="11" Text="{Binding SelectedMember.Name}"
+                     TextTrimming="CharacterEllipsis" VerticalAlignment="Center" />
+        </StackPanel>
+
+        <Button Classes="primary" Content="SHARE KEY" Command="{Binding ShareVaultCommand}"
+                IsEnabled="{Binding !IsBusy}" />
+
+        <!--
+          The sentence the desktop hangs off a tooltip, which a phone cannot show — so it is body text
+          under the button, where it is read before the tap rather than after it. It is not decoration:
+          the key-log check proves this server has been consistent with itself and nothing more.
+        -->
+        <TextBlock Classes="body"
+                   Text="Their published key is checked against the server's append-only key log first, and nothing is wrapped if it does not appear there unchanged. That proves the server has been consistent with itself — not that the key is the right person's. Compare the fingerprint with them over a channel this server does not carry before sharing anything that matters." />
+
+      </StackPanel>
+    </Border>
+
+  </Grid>
+
+</UserControl>

src/DodoSSH.Client.Android/Views/VaultsScreen.axaml.cs

@@ -0,0 +1,10 @@
+using Avalonia.Controls;
+using Avalonia.Markup.Xaml;
+
+namespace DodoSSH.Client.Android.Views;
+
+/// <summary>Vaults, under MORE — who is in each, and which of them this phone can open.</summary>
+internal sealed partial class VaultsScreen : UserControl
+{
+    public VaultsScreen() => AvaloniaXamlLoader.Load(this);
+}

src/DodoSSH.Client.Api/DodoSshApiClient.cs

@@ -189,6 +189,19 @@ public interface IDirectoryApi
 /// </remarks>
 public interface IVaultGrantApi
 {
+    /// <summary>
+    /// Renames a vault.
+    /// </summary>
+    /// <remarks>
+    /// Here rather than on <see cref="ITeamApi"/> because the subject is a vault, and because the vaults
+    /// screen that calls it is about vaults — the team a vault belongs to is behind it, and renaming one
+    /// is not an operation on the team. The server renames that team with it where it owns nothing else.
+    /// </remarks>
+    Task<VaultSummary> RenameVaultAsync(
+        Guid vaultId,
+        UpdateVaultRequest request,
+        CancellationToken cancellationToken);
+
     /// <summary>Lists who holds a key to this vault.</summary>
     Task<VaultGrantsResponse> ListVaultGrantsAsync(Guid vaultId, CancellationToken cancellationToken);
 
@@ -559,6 +572,18 @@ public sealed class DodoSshApiClient(HttpClient http, IAccessTokenProvider token
             HttpMethod.Get, path, null, DodoSshJsonContext.Default.KeyLogPage, cancellationToken);
     }
 
+    /// <inheritdoc />
+    public Task<VaultSummary> RenameVaultAsync(
+        Guid vaultId,
+        UpdateVaultRequest request,
+        CancellationToken cancellationToken) =>
+        SendAsync(
+            HttpMethod.Put,
+            string.Create(CultureInfo.InvariantCulture, $"/api/v1/vaults/{vaultId}"),
+            JsonContent.Create(request, DodoSshJsonContext.Default.UpdateVaultRequest),
+            DodoSshJsonContext.Default.VaultSummary,
+            cancellationToken);
+
     /// <inheritdoc />
     public Task<VaultGrantsResponse> ListVaultGrantsAsync(
         Guid vaultId,

src/DodoSSH.Client.App/Views/ConfirmDeleteCard.axaml.cs

@@ -8,7 +8,7 @@ namespace DodoSSH.Client.App.Views;
 /// <remarks>
 /// Its data context is the <c>VaultViewModel</c>, in all three of the places it is shown, so every binding
 /// in the markup is a property of the vault. See <see cref="HostDrawer"/>, <see cref="HostsScreen"/> and
-/// <see cref="VaultScreen"/>.
+/// <see cref="KeychainScreen"/>.
 /// </remarks>
 internal sealed partial class ConfirmDeleteCard : UserControl
 {

src/DodoSSH.Client.App/Views/HostDrawer.axaml

@@ -49,11 +49,16 @@
     hosts screen is a sibling of the WebView. See MainWindow.axaml's occlusion rule.
 
     ── WHAT THE DESIGN DRAWS HERE AND THIS PANE HAS NOT GOT ─────────────────────────────────────────────
-    Share this host, Add Telnet, "SSH ID, Certificate, FIDO2", the backspace-key mapping row and the vault
-    picker's chevron. Five controls with nothing behind them: sharing is per vault and not per item, every
-    session here is an SSH channel, there are no identity or certificate item types, nothing carries a
-    terminal setting to the renderer, and an item cannot be moved between vaults at all. They are listed in
-    docs/design-import-gaps.md with what ships instead, and none of them is drawn disabled.
+    Share this host, Add Telnet, "SSH ID, Certificate, FIDO2", and the backspace-key mapping row. Four
+    controls with nothing behind them: sharing is per vault and not per item, every session here is an SSH
+    channel, there are no identity or certificate item types, and nothing carries a terminal setting to the
+    renderer. They are listed in docs/design-import-gaps.md with what ships instead, and none of them is
+    drawn disabled.
+
+    The design's fifth missing control was the vault picker's chevron, and half of it now exists: a host
+    being *created* is asked which vault it goes into, in the editor below. What still does not exist is
+    the other half — moving an existing host — because the two vaults are encrypted under different keys,
+    so that is a delete and a retype rather than an edit.
   -->
 
   <Border Width="304" Background="{StaticResource Sidebar}"
@@ -66,10 +71,11 @@
         One row for all three panels, which is why what it says is on the view model rather than repeated
         three times here. See VaultViewModel.DrawerTitle.
 
-        The subtitle is the keychain this host is filed in, and the design's chevron beside it is not drawn:
+        The subtitle is the vault this host is filed in, and the design's chevron beside it is not drawn:
         an item cannot be moved between vaults — the two are encrypted under different keys, so moving one
         is a delete and a retype — and a picker offering the move would be offering something no layer below
-        this can do.
+        this can do. Choosing the vault at the moment a host is created is a different question and does
+        have an answer; it is in the editor, beside the name.
       -->
       <Border Grid.Row="0" Padding="14,10" Background="{StaticResource Panel}"
               BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
@@ -358,6 +364,35 @@
 
                 <TextBox Text="{Binding EditorLabel}" PlaceholderText="name" />
 
+                <!--
+                  ◆ WHICH VAULT THIS HOST WILL LIVE IN, asked here because it is the one decision on this
+                  form that cannot be changed afterwards: the vaults are encrypted under different keys, so
+                  moving an item between them is a delete and a retype. It is a field of the host rather
+                  than the keychain screen's standing "new items go to" preference, and it is a separate
+                  selection from it — moving this one does not move that one, and a click over there cannot
+                  move a host half-typed here.
+
+                  Shown only while adding, and only where there is more than one vault that can be written
+                  to. An existing host's row is not drawn at all rather than drawn disabled; the drawer's
+                  header already says where the host is filed. See VaultViewModel.ShowsEditorVaultChoice.
+
+                  The group picker below follows it: a group is an item in one vault, so choosing a vault
+                  refills that list with that vault's groups and clears what was chosen from another's.
+                -->
+                <StackPanel Spacing="4" IsVisible="{Binding ShowsEditorVaultChoice}">
+                  <ComboBox ItemsSource="{Binding EditorVaultChoices}"
+                            SelectedItem="{Binding EditorSelectedVault}"
+                            HorizontalAlignment="Stretch">
+                    <ComboBox.ItemTemplate>
+                      <DataTemplate x:DataType="vm:VaultChoiceViewModel">
+                        <TextBlock Text="{Binding Display}" FontSize="12" />
+                      </DataTemplate>
+                    </ComboBox.ItemTemplate>
+                  </ComboBox>
+                  <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                             Text="A host in a shared vault is readable by everybody holding that vault's key, and it cannot be moved out afterwards." />
+                </StackPanel>
+
                 <!--
                   Which group this host is filed under. Inside the encrypted payload like everything else
                   here, so the server learns nothing about how the estate is organised — and a group the

src/DodoSSH.Client.App/Views/HostsScreen.axaml.cs

@@ -17,7 +17,7 @@ namespace DodoSSH.Client.App.Views;
 /// right-clicked, and the drawer beside the grid has none of those. See <see cref="HostDrawer"/>.
 /// </para>
 /// <para>
-/// Its data context is the <c>VaultViewModel</c>, as <see cref="VaultScreen"/>'s is, so every binding in the
+/// Its data context is the <c>VaultViewModel</c>, as <see cref="KeychainScreen"/>'s is, so every binding in the
 /// markup is a property of the vault. The window hands it over; see <see cref="MainWindow"/>. The drawer
 /// beside the grid inherits the same one.
 /// </para>

src/DodoSSH.Client.App/Views/KeychainScreen.axaml

@@ -3,7 +3,7 @@
              xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
              xmlns:views="using:DodoSSH.Client.App.Views"
              xmlns:ssh="using:DodoSSH.Client.Ssh"
-             x:Class="DodoSSH.Client.App.Views.VaultScreen"
+             x:Class="DodoSSH.Client.App.Views.KeychainScreen"
              x:DataType="vm:VaultViewModel">
 
   <!--
@@ -136,7 +136,7 @@
               </ComboBox.ItemTemplate>
             </ComboBox>
             <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                       Text="An item filed into a team's vault is readable by everyone holding that vault's key. It defaults to your own and never moves on its own." />
+                       Text="An item filed into a shared vault is readable by everyone holding that vault's key. It defaults to your own and never moves on its own. A host is asked separately, in its own editor." />
           </StackPanel>
 
           <!--

src/DodoSSH.Client.App/Views/KeychainScreen.axaml.cs

@@ -11,9 +11,9 @@ namespace DodoSSH.Client.App.Views;
 /// one vault rather than two view models, because the two show different projections of the same four lists
 /// and a second view model would have to keep a copy of them in step.
 /// </remarks>
-internal sealed partial class VaultScreen : UserControl
+internal sealed partial class KeychainScreen : UserControl
 {
-    public VaultScreen() => InitializeComponent();
+    public KeychainScreen() => InitializeComponent();
 
     /// <summary>Where the keyboard lands when this screen is the one showing.</summary>
     /// <remarks>

src/DodoSSH.Client.App/Views/MainWindow.axaml

@@ -152,11 +152,11 @@
               <!--
                 Wrapped rather than bound directly, for the reason the vault column always was: this
                 element's visibility is the shell's business and its data context is the vault, and put both
-                on one element and IsVisible resolves against the vault as well, where IsVaultScreen does
+                on one element and IsVisible resolves against the vault as well, where IsKeychainScreen does
                 not exist.
               -->
-              <Panel IsVisible="{Binding IsVaultScreen}">
-                <views:VaultScreen x:Name="VaultPane" DataContext="{Binding Vault}" />
+              <Panel IsVisible="{Binding IsKeychainScreen}">
+                <views:KeychainScreen x:Name="VaultPane" DataContext="{Binding Vault}" />
               </Panel>
 
               <!-- ============ HOST KEYS ============ -->
@@ -180,14 +180,17 @@
                 <views:LogsScreen x:Name="LogsPane" DataContext="{Binding LogsScreen}" />
               </Panel>
 
-              <!-- ============ TEAM ============ -->
+              <!-- ============ VAULTS ============ -->
               <!--
-                Wrapped, for the reason the vault and transfers screens are: the visibility is the shell's
-                business and the data context is the teams view model, and both on one element would resolve
-                IsTeamScreen against a type that does not have it.
+                Wrapped, for the reason the keychain and transfers screens are: the visibility is the shell's
+                business and the data context is the vaults view model, and both on one element would resolve
+                IsVaultsScreen against a type that does not have it.
+
+                Bound to Vaults, which is the vaults themselves and the people in them — not to Vault, which
+                is one vault's contents and is what the keychain and hosts screens above draw.
               -->
-              <Panel IsVisible="{Binding IsTeamScreen}">
-                <views:TeamsScreen DataContext="{Binding Teams}" />
+              <Panel IsVisible="{Binding IsVaultsScreen}">
+                <views:VaultsScreen DataContext="{Binding Vaults}" />
               </Panel>
 
               <!-- ============ PREFERENCES ============ -->

src/DodoSSH.Client.App/Views/MainWindow.axaml.cs

@@ -112,7 +112,7 @@ internal sealed partial class MainWindow : Window
     private IInputElement KeyboardHome => shell switch
     {
         { IsTerminalShowing: true } => Terminal,
-        { Screen: ShellScreen.Vault } => VaultPane.KeyboardTarget,
+        { Screen: ShellScreen.Keychain } => VaultPane.KeyboardTarget,
         { Screen: ShellScreen.Hosts } => HostsPane.KeyboardTarget,
         { Screen: ShellScreen.KnownHosts } => PinsPane.KeyboardTarget,
         { Screen: ShellScreen.Import } => ImportPane.KeyboardTarget,

src/DodoSSH.Client.App/Views/NavRail.axaml

@@ -33,10 +33,10 @@
     was where "how many buckets" was printed. It is on the S3 screen itself, which is where somebody
     counting buckets is going anyway.
 
-    One of the destinations — TEAM — reaches a screen that says it is not built. It is in the list anyway
-    rather than dropped, and the reasoning is in ShellScreen: the milestones are public, the screen behind it
-    says plainly what is missing, and a list that quietly had fewer entries would make sharing look like a
-    change of product rather than the next milestone. FILES was the other one until M2 built it.
+    The last entry was TEAMS and is now VAULTS, which is a change of subject rather than of destination: the
+    screen behind it lists vaults and the people in each, where it used to list teams that owned vaults. See
+    VaultsViewModel. It shares its word with the tab strip's first tab; the two are different levels of the
+    window, and the button's own comment says which is which.
 
     Buttons rather than a TabStrip or a ListBox, for the same reason the vault's category rail is: all three
     of those hold the selection themselves, so a click moves the highlight before the shell can decide
@@ -76,9 +76,9 @@
           with the list under it. It no longer does: buckets have their own entry above, so this number and
           this screen now count the same things.
         -->
-        <Button Classes="flat nav" Classes.active="{Binding IsVaultShowing}"
+        <Button Classes="flat nav" Classes.active="{Binding IsKeychainShowing}"
                 Command="{Binding ShowScreenCommand}"
-                CommandParameter="{x:Static vm:ShellScreen.Vault}"
+                CommandParameter="{x:Static vm:ShellScreen.Keychain}"
                 ToolTip.Tip="Your keychain: SSH keys and stored passwords">
           <Grid ColumnDefinitions="Auto,*,Auto">
             <TextBlock Grid.Column="0" Classes="navicon" Text="⚿" />
@@ -125,18 +125,27 @@
           </Grid>
         </Button>
 
-        <Button Classes="flat nav" Classes.active="{Binding IsTeamShowing}"
+        <!--
+          ◆ THIS ENTRY SAID Teams UNTIL THE SCREEN BEHIND IT STOPPED BEING ABOUT THEM. A team is still what
+          the server authorises against; it is no longer something anybody has to make, name or think about,
+          so the rail names the thing people came for. See VaultsViewModel.
+
+          It shares a word with the tab strip's first tab, which is a different level of the window: that
+          tab is "this application rather than SFTP or S3", and this is one of the nine screens under it.
+        -->
+        <Button Classes="flat nav" Classes.active="{Binding IsVaultsShowing}"
                 Command="{Binding ShowScreenCommand}"
-                CommandParameter="{x:Static vm:ShellScreen.Team}"
-                ToolTip.Tip="Shared keychains and the people in them">
+                CommandParameter="{x:Static vm:ShellScreen.Vaults}"
+                ToolTip.Tip="Your vaults, the people in each one, and who holds a key">
           <Grid ColumnDefinitions="Auto,*,Auto">
             <TextBlock Grid.Column="0" Classes="navicon" Text="◎" />
             <!--
-              No count. Teams are read from the server when the screen is opened, not on unlock, so this
-              would read 0 until somebody had already been there — which is the one number on this list
-              that would be a statement rather than a blank.
+              No count. The vault list is the session's and could be counted here — but who is in each one
+              is read from the server when the screen is opened, not on unlock, and a number naming only
+              half of what the screen is about would be the one figure on this list that has to be
+              explained.
             -->
-            <TextBlock Grid.Column="1" Classes="navlabel" Text="Teams" />
+            <TextBlock Grid.Column="1" Classes="navlabel" Text="Vaults" />
           </Grid>
         </Button>
 

src/DodoSSH.Client.App/Views/PreferencesScreen.axaml

@@ -191,7 +191,7 @@
         <TextBlock Classes="gap"
                    Text="Per-use approval before a key signs — keys are handed to the SSH stack whole at connect time, so there is no per-signature moment to interrupt." />
         <TextBlock Classes="gap"
-                   Text="SSO and team policy — the server has no team endpoints, so there is no policy for this screen to show." />
+                   Text="SSO and organisation policy — the server has endpoints for membership and none for policy, so there is nothing for this screen to show." />
         <TextBlock Classes="gap"
                    Text="Keyboard shortcuts — the window binds one chord, and the terminal keeps the rest for the remote." />
       </ItemsControl>

src/DodoSSH.Client.App/Views/TeamsScreen.axaml.cs

@@ -1,9 +0,0 @@
-using Avalonia.Controls;
-
-namespace DodoSSH.Client.App.Views;
-
-/// <summary>Teams: who is in one, what they may do, and which vaults they hold a key to.</summary>
-internal sealed partial class TeamsScreen : UserControl
-{
-    public TeamsScreen() => InitializeComponent();
-}

src/DodoSSH.Client.App/Views/TerminalTabs.axaml

@@ -162,7 +162,7 @@
                           HorizontalContentAlignment="Left"
                           Content="New vault…"
                           Click="OnNewVaultPressed"
-                          ToolTip.Tip="Names a vault and makes a team to own it, so you can invite people to it and give them roles" />
+                          ToolTip.Tip="Names a vault you can share, and opens it on the Vaults screen so you can add people to it and give them roles" />
 
                 </StackPanel>
               </Flyout>

src/DodoSSH.Client.App/Views/VaultsScreen.axaml

@@ -2,141 +2,140 @@
              xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
              xmlns:vm="using:DodoSSH.Client.Shell.ViewModels"
              xmlns:contracts="using:DodoSSH.Contracts"
-             x:Class="DodoSSH.Client.App.Views.TeamsScreen"
-             x:DataType="vm:TeamsViewModel">
+             x:Class="DodoSSH.Client.App.Views.VaultsScreen"
+             x:DataType="vm:VaultsViewModel">
 
   <!--
-    Teams.
+    Vaults, and the people in each of them.
 
-    The screen is built around one fact that every other product in this category hides: adding somebody to
-    a team and giving them a vault key are two different acts, and only the first is something a server can
-    do. The second needs a machine that holds the key, because this server never does. So the members table
-    and the vaults table are side by side, an addition says out loud that it granted nothing readable yet,
-    and SHARE KEY is its own button rather than a checkbox on the member row.
+    ── THIS WAS THE TEAMS SCREEN, AND THE TEAM IS NOW BEHIND THE VAULT. ─────────────────────────────────
+    The left column used to list teams; a team owned vaults, and sharing meant creating a team, then a
+    vault in it, then wrapping a key. Two of those three steps were about a concept nobody came here for.
+    So the rows are vaults now: naming one makes the membership list that carries it, and everything on
+    the right — members, invitations, key holders — is that vault's. The server still authorises against
+    a team, because that is what VaultAccessService resolves; what went is the requirement that a person
+    know it exists. The one case where it is still visible is a membership list carrying several vaults,
+    which this screen cannot make and will not hide: see SharedMembershipWarning.
+
+    ── THE ONE FACT THE WHOLE SCREEN IS BUILT AROUND ────────────────────────────────────────────────────
+    Adding somebody to a vault and giving them its key are two different acts, and only the first is
+    something a server can do. The second needs a machine that holds the key, because this server never
+    does. So the members list and the key-holders list are both here and are not the same list, an
+    addition says out loud that it granted nothing readable yet, and SHARE KEY is its own button rather
+    than a checkbox on the member row.
 
     What the design asked for and is still not here: two-factor state (no such concept exists anywhere in
-    this product) and avatars (no picture is stored anywhere). Invitations and last-active are here, and
-    both are narrower than the design drew. Nothing is sent — there is no outbound mail path and no token,
-    so an invitation is a standing instruction that the next account signing in with that address joins the
-    team, and there is consequently nothing to resend. Last-active is recorded at most once per account per
-    hour, so it is drawn coarsely rather than to the minute. None of it is drawn with invented data.
+    this product) and avatars (no picture is stored anywhere). Nothing is sent for an invitation — there
+    is no outbound mail path and no token, so an invitation is a standing instruction that the next
+    account signing in with that address joins, and there is consequently nothing to resend. Last-active
+    is recorded at most once per account per hour, so it is drawn coarsely. Nor is there a way to delete a
+    vault: the server has no such call, and the screen says so rather than offering a button that refuses.
   -->
 
   <Grid ColumnDefinitions="268,*">
 
-    <!-- ============ The team list ============ -->
+    <!-- ============ The vault list ============ -->
     <Border Grid.Column="0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,1,0">
       <Grid RowDefinitions="44,*,Auto">
 
         <Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
           <Grid ColumnDefinitions="*,Auto" VerticalAlignment="Center">
-            <TextBlock Grid.Column="0" Classes="mono" Text="TEAMS" FontSize="12" FontWeight="SemiBold"
+            <TextBlock Grid.Column="0" Classes="mono" Text="VAULTS" FontSize="12" FontWeight="SemiBold"
                        LetterSpacing="1" Foreground="{StaticResource Text}" VerticalAlignment="Center" />
             <Button Grid.Column="1" Classes="ghost" Content="NEW"
-                    Command="{Binding NewTeamCommand}" IsEnabled="{Binding !IsBusy}" />
+                    Command="{Binding NewVaultCommand}" IsEnabled="{Binding !IsBusy}"
+                    ToolTip.Tip="Makes a vault you can share. Its key is generated on this machine, and nobody else has it until you hand it out." />
           </Grid>
         </Border>
 
         <ScrollViewer Grid.Row="1">
           <StackPanel>
-            <ListBox ItemsSource="{Binding Teams}" SelectedItem="{Binding SelectedTeam}"
+            <!--
+              Read from this machine's own vault list rather than from the server, so the column is right
+              with no connection. What is missing offline is who is in each one, which is why a row can
+              say its membership is unknown rather than saying nothing at all.
+            -->
+            <ListBox ItemsSource="{Binding Vaults}" SelectedItem="{Binding SelectedVault}"
                      Background="Transparent" BorderThickness="0">
               <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:TeamRowViewModel">
+                <DataTemplate x:DataType="vm:VaultRowViewModel">
                   <StackPanel Spacing="2" Margin="0,3">
                     <Grid ColumnDefinitions="*,Auto">
                       <TextBlock Grid.Column="0" Text="{Binding Name}" FontSize="13" FontWeight="Medium"
                                  Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
-                      <TextBlock Grid.Column="1" Classes="mono" Text="{Binding Role}" FontSize="10"
-                                 Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
+                      <TextBlock Grid.Column="1" Classes="mono" Text="{Binding RoleLabel}" FontSize="10"
+                                 Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
+                                 Margin="8,0,0,0" />
                     </Grid>
                     <TextBlock Classes="hint" FontSize="11" Text="{Binding Detail}" />
+                    <!--
+                      Only when there is something to say. A vault waiting for a key and one owing a rekey
+                      are both temporary and both need somebody to act; a permanent "fine" beside them
+                      would teach people to stop reading the line.
+                    -->
+                    <TextBlock Classes="hint" FontSize="10.5" Text="{Binding State}"
+                               TextWrapping="Wrap" IsVisible="{Binding HasState}" />
                   </StackPanel>
                 </DataTemplate>
               </ListBox.ItemTemplate>
             </ListBox>
 
             <TextBlock Classes="hint" FontSize="11" Margin="14,12" TextWrapping="Wrap"
-                       IsVisible="{Binding !HasTeams}"
-                       Text="No teams yet. A team is what makes a vault shareable: its vaults can be opened by every member you wrap a key to." />
+                       IsVisible="{Binding !HasVaults}"
+                       Text="No vaults yet. Unlock your keychain to see the personal one, or make a vault to share hosts and credentials with colleagues." />
           </StackPanel>
         </ScrollViewer>
 
-        <!-- The create forms, in place rather than in a modal: this window has no idiom for one. -->
-        <StackPanel Grid.Row="2">
+        <!--
+          The name-a-vault form, in place rather than in a modal: this window has no idiom for one. It is
+          in this column rather than beside the pane on the right for one reason — that pane is bound to
+          HasSelection, so with no vaults at all it is not on screen, and "no vaults at all" is exactly
+          the state somebody arrives in from the tab strip's New vault entry.
 
-          <Border Padding="14,12" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
-                  IsVisible="{Binding IsCreatingTeam}">
-            <StackPanel Spacing="8">
-              <TextBlock Classes="label" Text="NEW TEAM" />
-              <TextBox PlaceholderText="Name" Text="{Binding NewTeamName}" />
-              <TextBox PlaceholderText="slug-for-urls" Text="{Binding NewTeamSlug}" />
-              <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                         Text="The slug is lowercase letters, digits and hyphens, and has to be unique across this server." />
-              <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="accent" Content="CREATE" Command="{Binding CreateTeamCommand}"
-                        IsEnabled="{Binding !IsBusy}" />
-                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelNewTeamCommand}" />
-              </StackPanel>
+          One field. The membership list behind it is made with it and named after it, and its slug is
+          derived — see VaultsViewModel.CreateVaultAsync. Asking for a URL handle would be asking for one
+          from somebody who has not been told they are making anything but a vault.
+        -->
+        <Border Grid.Row="2" Padding="14,12" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
+                IsVisible="{Binding IsCreatingVault}">
+          <StackPanel Spacing="8">
+            <TextBlock Classes="label" Text="NEW VAULT" />
+            <TextBox PlaceholderText="Name" Text="{Binding NewVaultName}" />
+            <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
+                       Text="Its key is made on this machine and nobody else has it. Add people to it once it exists, then press SHARE KEY." />
+            <StackPanel Orientation="Horizontal" Spacing="6">
+              <Button Classes="accent" Content="CREATE" Command="{Binding CreateVaultCommand}"
+                      IsEnabled="{Binding !IsBusy}" />
+              <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelNewVaultCommand}" />
             </StackPanel>
-          </Border>
-
-          <!--
-            The name-a-vault form, and it is in this column rather than beside the VAULTS list it belongs to
-            for one reason: that list lives inside a ScrollViewer bound to HasSelection, so with no teams at
-            all it is not on screen — and "no teams at all" is exactly the state somebody arrives in from
-            the tab strip's New vault entry. Here it is reachable whatever else is true.
-
-            One field. A team is made behind it and named after the vault, and its slug is derived — see
-            TeamsViewModel.CreateVaultAsync. Asking for a slug as the form above does would be asking for a
-            URL handle from somebody who has not been told they are making a team.
-          -->
-          <Border Padding="14,12" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
-                  IsVisible="{Binding IsCreatingVault}">
-            <StackPanel Spacing="8">
-              <TextBlock Classes="label" Text="NEW VAULT" />
-              <TextBox PlaceholderText="Name" Text="{Binding NewVaultName}" />
-              <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                         Text="{Binding NewVaultDestination}" />
-              <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                         Text="Its key is made on this machine and nobody else has it yet. Add people to the team, then press SHARE KEY." />
-              <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="accent" Content="CREATE" Command="{Binding CreateVaultCommand}"
-                        IsEnabled="{Binding !IsBusy}" />
-                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelNewVaultCommand}" />
-              </StackPanel>
-            </StackPanel>
-          </Border>
-
-        </StackPanel>
+          </StackPanel>
+        </Border>
 
       </Grid>
     </Border>
 
-    <!-- ============ Members and vaults ============ -->
+    <!-- ============ The selected vault: who is in it, and who can open it ============ -->
     <Grid Grid.Column="1" RowDefinitions="44,*,Auto">
 
       <Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
         <Grid ColumnDefinitions="*,Auto" VerticalAlignment="Center">
-          <TextBlock Grid.Column="0" Classes="mono" Text="{Binding SelectedTeam.Name}" FontSize="12"
+          <TextBlock Grid.Column="0" Classes="mono" Text="{Binding SelectedVault.Name}" FontSize="12"
                      FontWeight="SemiBold" LetterSpacing="1" Foreground="{StaticResource Text}"
                      VerticalAlignment="Center" />
 
           <!--
-            The team's own operations. RENAME is an admin's; the other two are the owner's alone, and
-            that is the line the server draws as well — an admin the owner promoted must not be able
-            to archive the team or take it from them.
+            The vault's own operations. RENAME is an admin's; handing it on is the owner's alone, and
+            that is the line the server draws as well — an admin the owner promoted must not be able to
+            take the vault from them.
           -->
           <StackPanel Grid.Column="1" Orientation="Horizontal" Spacing="6"
-                      IsVisible="{Binding ShowsTeamActions}">
-            <Button Classes="ghost" Content="RENAME" Command="{Binding RenameTeamCommand}"
-                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanAdministerSelected}" />
-            <Button Classes="ghost" Content="HAND OVER" Command="{Binding TransferOwnershipCommand}"
+                      IsVisible="{Binding ShowsVaultActions}">
+            <Button Classes="ghost" Content="RENAME" Command="{Binding RenameVaultCommand}"
+                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanAdministerSelected}"
+                    ToolTip.Tip="Changes what this vault is called. The name is plaintext on the server, as it always was; nothing inside is re-encrypted." />
+            <Button Classes="ghost" Content="HAND OVER" Command="{Binding HandOverCommand}"
                     IsEnabled="{Binding !IsBusy}" IsVisible="{Binding OwnsSelected}"
-                    ToolTip.Tip="Hands this team to the selected member. They become the owner and you become an admin; only the new owner can hand it on again." />
-            <Button Classes="danger" Content="ARCHIVE" Command="{Binding ArchiveTeamCommand}"
-                    IsEnabled="{Binding !IsBusy}" IsVisible="{Binding OwnsSelected}"
-                    ToolTip.Tip="Takes the team out of every member's list. Refused while it still owns any vault, and only somebody with database access can bring it back." />
+                    ToolTip.Tip="Hands this vault to the selected member. They become its owner and you become an admin; only the new owner can hand it on again." />
           </StackPanel>
         </Grid>
       </Border>
@@ -146,24 +145,22 @@
 
           <!-- The rename form, in place, exactly as the create form on the left is. -->
           <Border Padding="12" CornerRadius="4" BorderThickness="1"
-                  BorderBrush="{StaticResource Border}" IsVisible="{Binding IsEditingTeam}">
+                  BorderBrush="{StaticResource Border}" IsVisible="{Binding IsRenamingVault}">
             <StackPanel Spacing="8">
-              <TextBlock Classes="label" Text="RENAME TEAM" />
-              <TextBox PlaceholderText="Name" Text="{Binding EditTeamName}" />
-              <TextBox PlaceholderText="What this team is for (optional)"
-                       Text="{Binding EditTeamDescription}" />
+              <TextBlock Classes="label" Text="RENAME VAULT" />
+              <TextBox PlaceholderText="Name" Text="{Binding EditVaultName}" />
               <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
-                         Text="The slug does not change. It is what URLs and the server's own records use, and it is unique only among live teams — so a rename that moved it could take one an archived team is still holding." />
+                         Text="Everybody who shares this vault sees the new name. Nothing is re-encrypted and no key changes; the name has always been stored in plain text, because a person has to be able to pick a vault before anything is decrypted." />
               <StackPanel Orientation="Horizontal" Spacing="6">
-                <Button Classes="accent" Content="SAVE" Command="{Binding SaveTeamCommand}"
+                <Button Classes="accent" Content="SAVE" Command="{Binding SaveVaultNameCommand}"
                         IsEnabled="{Binding !IsBusy}" />
-                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelRenameTeamCommand}" />
+                <Button Classes="ghost" Content="CANCEL" Command="{Binding CancelRenameVaultCommand}" />
               </StackPanel>
             </StackPanel>
           </Border>
 
           <!--
-            The armed confirmation, drawn where the buttons that armed it were. The vault screen's
+            The armed confirmation, drawn where the buttons that armed it were. The keychain screen's
             idiom, and for the same reason: there is no modal anywhere in this window.
           -->
           <Border Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
@@ -182,15 +179,35 @@
             </StackPanel>
           </Border>
 
+          <!--
+            The personal vault, which is the one vault sharing cannot reach. Said here rather than by
+            drawing the members section empty: an empty MEMBERS heading over a vault that can never have
+            any reads as a feature that has not loaded.
+          -->
+          <StackPanel Spacing="8" IsVisible="{Binding SelectedIsPersonal}">
+            <TextBlock Classes="label" Text="YOURS ALONE" />
+            <TextBlock Classes="hint" FontSize="11.5" TextWrapping="Wrap"
+                       Text="Nobody can be added to your personal vault, and the server refuses a key grant on one outright — a key wrapped to somebody it will go on refusing to serve would look like sharing and would not be. Make a vault above for the things you want to share, and put them in it." />
+          </StackPanel>
+
           <!-- Members -->
 
-          <StackPanel Spacing="8">
+          <StackPanel Spacing="8" IsVisible="{Binding SelectedIsShared}">
             <TextBlock Classes="label" Text="MEMBERS" />
 
+            <!--
+              Only ever non-empty for a membership list this screen did not make. Adding somebody to one
+              vault and silently adding them to three others is precisely the fact a vault-shaped screen
+              is in a position to hide, so it says it instead.
+            -->
+            <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
+                       IsVisible="{Binding HasSharedMembershipWarning}"
+                       Text="{Binding SharedMembershipWarning}" />
+
             <ListBox ItemsSource="{Binding Members}" SelectedItem="{Binding SelectedMember}"
                      Background="Transparent" BorderThickness="0" MaxHeight="240">
               <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:TeamMemberRowViewModel">
+                <DataTemplate x:DataType="vm:VaultMemberRowViewModel">
                   <Grid ColumnDefinitions="*,168,Auto" Margin="0,3">
                     <StackPanel Grid.Column="0" Spacing="2">
                       <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
@@ -215,7 +232,7 @@
               key editor and the category rail already make and for the reason they record: a selector
               moves its own highlight before anything can refuse, so it can end up showing a role
               nobody was given. OWNER is absent because it is not a role that can be assigned —
-              handing the team over is its own act, with its own confirmation.
+              handing the vault over is its own act, with its own confirmation.
             -->
             <StackPanel Spacing="6" IsVisible="{Binding CanAdministerSelected}">
               <TextBlock Classes="label" Text="SET THE SELECTED MEMBER'S ROLE" />
@@ -223,27 +240,27 @@
                 <Button Classes="flat choice" Content="VIEWER" Command="{Binding ChangeRoleCommand}"
                         CommandParameter="{x:Static contracts:TeamMemberRole.Viewer}"
                         IsEnabled="{Binding !IsBusy}"
-                        ToolTip.Tip="May pull this team's vaults and may not push. It does not withdraw a vault key they already hold." />
+                        ToolTip.Tip="May pull this vault and may not push. It does not withdraw a key they already hold." />
                 <Button Classes="flat choice" Content="MEMBER" Command="{Binding ChangeRoleCommand}"
                         CommandParameter="{x:Static contracts:TeamMemberRole.Member}"
                         IsEnabled="{Binding !IsBusy}"
-                        ToolTip.Tip="May read and change this team's vaults." />
+                        ToolTip.Tip="May read and change what is in this vault." />
                 <Button Classes="flat choice" Content="ADMIN" Command="{Binding ChangeRoleCommand}"
                         CommandParameter="{x:Static contracts:TeamMemberRole.Admin}"
                         IsEnabled="{Binding !IsBusy}"
-                        ToolTip.Tip="May also manage members, create vaults and share vault keys." />
+                        ToolTip.Tip="May also add and remove people, rename the vault, and share its key." />
               </StackPanel>
             </StackPanel>
 
             <Grid ColumnDefinitions="*,Auto,Auto" IsVisible="{Binding CanAdministerSelected}">
               <TextBox Grid.Column="0" PlaceholderText="colleague@example.com" Text="{Binding InviteEmail}"
                        Margin="0,0,6,0" />
-              <Button Grid.Column="1" Classes="accent" Content="ADD MEMBER"
+              <Button Grid.Column="1" Classes="accent" Content="ADD"
                       Command="{Binding AddMemberCommand}" IsEnabled="{Binding !IsBusy}"
                       ToolTip.Tip="Adds the account with this address, or invites the address if there is no account here yet. Nothing is sent either way — tell them yourself." />
               <Button Grid.Column="2" Classes="danger" Content="REMOVE" Margin="6,0,0,0"
                       Command="{Binding RemoveMemberCommand}" IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Removes the selected member and withdraws every vault key they hold from this team. It blocks future reads only — anything already on their machine stays there, so rotate the credentials that matter." />
+                      ToolTip.Tip="Removes the selected member and withdraws every key they hold to this vault. It blocks future reads only — anything already on their machine stays there, so rotate the credentials that matter." />
             </Grid>
 
             <StackPanel Spacing="4" IsVisible="{Binding CanAdministerSelected}">
@@ -263,12 +280,12 @@
 
             <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
                        IsVisible="{Binding CanAdministerSelected}"
-                       Text="Adding somebody lets the server serve them this team's vaults. It does not let them read one: a vault key can only be wrapped by a machine that already holds it, which is what SHARE KEY below does." />
+                       Text="Adding somebody lets the server serve them this vault. It does not let them read it: a vault key can only be wrapped by a machine that already holds it, which is what SHARE KEY below does." />
           </StackPanel>
 
           <!--
-            Invitations, drawn only when there are any. An empty INVITED heading on every team would be
-            a permanent reminder of a feature most teams never use.
+            Invitations, drawn only when there are any. An empty INVITED heading on every vault would be
+            a permanent reminder of a feature most people never use.
           -->
           <StackPanel Spacing="8" IsVisible="{Binding HasInvitations}">
             <Border Height="1" Background="{StaticResource BorderSubtle}" />
@@ -278,7 +295,7 @@
             <ListBox ItemsSource="{Binding Invitations}" SelectedItem="{Binding SelectedInvitation}"
                      Background="Transparent" BorderThickness="0" MaxHeight="160">
               <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:TeamInvitationRowViewModel">
+                <DataTemplate x:DataType="vm:VaultInvitationRowViewModel">
                   <Grid ColumnDefinitions="*,Auto" Margin="0,3">
                     <StackPanel Grid.Column="0" Spacing="2">
                       <TextBlock Text="{Binding Email}" FontSize="13" FontWeight="Medium"
@@ -297,67 +314,36 @@
             <Button Classes="danger" Content="WITHDRAW INVITATION" HorizontalAlignment="Left"
                     Command="{Binding RevokeInvitationCommand}" IsEnabled="{Binding !IsBusy}"
                     IsVisible="{Binding CanAdministerSelected}"
-                    ToolTip.Tip="Signing in with that address will no longer put them in this team. An invitation already taken up is a membership — remove the member instead." />
+                    ToolTip.Tip="Signing in with that address will no longer put them in this vault. An invitation already taken up is a membership — remove the member instead." />
           </StackPanel>
 
           <Border Height="1" Background="{StaticResource BorderSubtle}" />
 
-          <!-- Vaults -->
+          <!-- Who holds the key -->
 
           <StackPanel Spacing="8">
-            <Grid ColumnDefinitions="*,Auto">
-              <TextBlock Grid.Column="0" Classes="label" Text="VAULTS" VerticalAlignment="Center" />
-              <!--
-                Opens the form under the team list rather than creating one outright. It used to create a
-                vault named after the team, which meant a team with three of them held three vaults with
-                the same name and no way to tell them apart.
-              -->
-              <Button Grid.Column="1" Classes="ghost" Content="NEW VAULT"
-                      Command="{Binding NewVaultCommand}"
-                      IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanAdministerSelected}" />
-            </Grid>
-
-            <ListBox ItemsSource="{Binding Vaults}" SelectedItem="{Binding SelectedVault}"
-                     Background="Transparent" BorderThickness="0" MaxHeight="200">
-              <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:TeamVaultRowViewModel">
-                  <StackPanel Spacing="2" Margin="0,3">
-                    <TextBlock Text="{Binding Name}" FontSize="13" FontWeight="Medium"
-                               Foreground="{StaticResource Text}" />
-                    <TextBlock Classes="hint" FontSize="11" Text="{Binding State}" />
-                  </StackPanel>
-                </DataTemplate>
-              </ListBox.ItemTemplate>
-            </ListBox>
-
-            <TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
-                       IsVisible="{Binding !HasSelection}"
-                       Text="Select a team to see its vaults." />
-
-            <StackPanel Orientation="Horizontal" Spacing="6">
+            <StackPanel Orientation="Horizontal" Spacing="6" IsVisible="{Binding SelectedIsShared}">
               <Button Classes="accent" Content="SHARE KEY" Command="{Binding ShareVaultCommand}"
                       IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Wraps the selected vault's key to the selected member. Their published key is checked against the server's append-only key log first, and nothing is wrapped if it does not appear there unchanged." />
+                      ToolTip.Tip="Wraps this vault's key to the selected member. Their published key is checked against the server's append-only key log first, and nothing is wrapped if it does not appear there unchanged." />
               <Button Classes="danger" Content="WITHDRAW KEY" Command="{Binding RevokeVaultCommand}"
                       IsEnabled="{Binding !IsBusy}"
-                      ToolTip.Tip="Withdraws the selected member's key to the selected vault. Blocks future reads only." />
+                      ToolTip.Tip="Withdraws the selected member's key to this vault. Blocks future reads only." />
             </StackPanel>
 
             <!--
-              Who can open the selected vault — the design's "shared with" avatars, as names and a
-              state. Under the vault rather than beside the member, because a grant is per vault: a
-              count on a member row would imply per-item sharing, which is M5 and does not exist.
-              Withdrawn and stale grants stay listed and say which they are, because a list that
-              quietly dropped them would show a departed colleague as merely absent rather than as
-              somebody whose key was taken away. The dot is Live and means exactly what it says: this
-              person can open this vault right now.
+              Who can open this vault — the design's "shared with" avatars, as names and a state.
+              Withdrawn and stale grants stay listed and say which they are, because a list that quietly
+              dropped them would show a departed colleague as merely absent rather than as somebody whose
+              key was taken away. The dot is Live and means exactly what it says: this person can open
+              this vault right now.
             -->
             <TextBlock Classes="label" Text="KEY HOLDERS" />
 
             <ListBox ItemsSource="{Binding Grants}" Background="Transparent" BorderThickness="0"
                      MaxHeight="150">
               <ListBox.ItemTemplate>
-                <DataTemplate x:DataType="vm:TeamGrantRowViewModel">
+                <DataTemplate x:DataType="vm:VaultGrantRowViewModel">
                   <Grid ColumnDefinitions="10,*" Margin="0,3">
                     <Ellipse Grid.Column="0" Width="6" Height="6" VerticalAlignment="Center"
                              IsVisible="{Binding IsLive}" Fill="{StaticResource Live}" />
@@ -372,7 +358,16 @@
             </ListBox>
 
             <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
+                       IsVisible="{Binding SelectedIsShared}"
                        Text="Sharing verifies the recipient's key against the key log, which proves this server has been consistent with itself — not that the key is the right person's. Compare the fingerprint with them over a channel this server does not carry before sharing anything that matters." />
+
+            <!--
+              Said once, where somebody would otherwise go looking for a DELETE button. There is no call
+              for it anywhere in the server, and archiving the membership list behind a vault is refused
+              while the vault exists — so a button here would be one that always refuses.
+            -->
+            <TextBlock Classes="hint" FontSize="10.5" TextWrapping="Wrap"
+                       Text="A vault cannot be deleted. Nothing in this product removes one, and the server refuses to archive the membership list behind it while it still exists." />
           </StackPanel>
 
         </StackPanel>
@@ -380,7 +375,7 @@
 
       <TextBlock Grid.Row="1" Classes="hint" FontSize="12" Margin="20" TextWrapping="Wrap"
                  VerticalAlignment="Top" IsVisible="{Binding !HasSelection}"
-                 Text="Create a team on the left, or wait to be added to one. A team owns vaults; a vault's key is what makes its contents readable, and that key is handed out by people rather than by the server." />
+                 Text="Make a vault on the left, or wait for somebody to add you to one. A vault holds hosts and credentials that a group of people share; its key is what makes those readable, and that key is handed out by people rather than by the server." />
 
       <Border Grid.Row="2" Padding="14,10" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
               IsVisible="{Binding Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}">

src/DodoSSH.Client.App/Views/VaultsScreen.axaml.cs

@@ -0,0 +1,9 @@
+using Avalonia.Controls;
+
+namespace DodoSSH.Client.App.Views;
+
+/// <summary>Vaults: which there are, who is in each, and who holds a key to it.</summary>
+internal sealed partial class VaultsScreen : UserControl
+{
+    public VaultsScreen() => InitializeComponent();
+}

src/DodoSSH.Client.Session/VaultSharing.cs

@@ -94,6 +94,53 @@ public sealed partial class VaultSession
         }
     }
 
+    /// <summary>
+    /// Renames a vault, here and on the server.
+    /// </summary>
+    /// <param name="api">The vault calls.</param>
+    /// <param name="vaultId">The vault to rename.</param>
+    /// <param name="name">What to call it. Plaintext, as all vault names are.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <returns>The vault as this machine now holds it.</returns>
+    /// <remarks>
+    /// <para>
+    /// Nothing is re-encrypted. A vault's name is the one thing about it the server stores in the clear —
+    /// a person has to be able to choose a vault before anything is decrypted — so a rename is a plain
+    /// column write at both ends and touches no key.
+    /// </para>
+    /// <para>
+    /// <b>The cached row is edited rather than replaced with the response.</b> The server answers with a
+    /// summary written for a caller who is not this one: no wrapped key and no permissions, because it
+    /// has nothing to say about either that this session does not already hold. Replacing the cached row
+    /// with it would take this machine's own grant away and leave the vault unreadable until the next
+    /// refresh.
+    /// </para>
+    /// </remarks>
+    public async Task<StoredVault> RenameVaultAsync(
+        IVaultGrantApi api,
+        Guid vaultId,
+        string name,
+        CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(disposed, this);
+        ArgumentNullException.ThrowIfNull(api);
+        ArgumentException.ThrowIfNullOrWhiteSpace(name);
+
+        var summary = await api
+            .RenameVaultAsync(vaultId, new UpdateVaultRequest(name), cancellationToken)
+            .ConfigureAwait(false);
+
+        var stored = Vaults.FirstOrDefault(vault => vault.VaultId == vaultId) is { } known
+            ? known with { Name = summary.Name }
+            : ToStored(summary);
+
+        await Vault.UpsertAsync(stored, cancellationToken).ConfigureAwait(false);
+
+        Vaults = await Vault.ListAsync(cancellationToken).ConfigureAwait(false);
+
+        return stored;
+    }
+
     /// <summary>
     /// Wraps a vault's key to another member, after verifying their published key.
     /// </summary>

src/DodoSSH.Client.Shell/ViewModels/MainWindowViewModel.cs

@@ -31,11 +31,11 @@ internal sealed record VaultToggleViewModel(Guid VaultId, string Name, bool IsPe
 {
     /// <summary>What the switch says.</summary>
     /// <remarks>
-    /// A team vault is marked as one, exactly as it is in the "file this into" picker, and for a weaker
+    /// A shared vault is marked as one, exactly as it is in the "file this into" picker, and for a weaker
     /// version of the same reason: two vaults may hold a host with the same label, and which vault a switch
     /// is about is the only thing that tells the two switches apart.
     /// </remarks>
-    internal string Display => IsPersonal ? Name : $"{Name} · TEAM";
+    internal string Display => IsPersonal ? Name : $"{Name} · SHARED";
 
     /// <summary>Whether this vault can be switched off.</summary>
     /// <remarks>
@@ -100,11 +100,22 @@ internal enum ShellScreen
     /// <summary>File transfer over SFTP: two directory panes and a queue.</summary>
     Transfers = 1,
 
-    /// <summary>Everything in the vault that is not a host.</summary>
-    Vault = 2,
+    /// <summary>Everything in the open vault that is not a host: keys, passwords, buckets, tags.</summary>
+    /// <remarks>
+    /// Named for what the rail calls it rather than for the vault it reads, which is what it was called
+    /// when <see cref="Vaults"/> arrived beside it. Two members a letter apart, one meaning "one vault's
+    /// contents" and the other "the vaults themselves", is a pair somebody eventually gets the wrong way
+    /// round.
+    /// </remarks>
+    Keychain = 2,
 
-    /// <summary>Shared vaults and the people in them. Both heads draw it.</summary>
-    Team = 3,
+    /// <summary>The vaults themselves and the people in them. Both heads draw it.</summary>
+    /// <remarks>
+    /// Was <c>Team</c>, and the value is unchanged with it: the screen is the same destination, and these
+    /// numbers are written into <c>NavRail.axaml</c> as <c>x:Static</c> literals. What changed is what the
+    /// screen is about — see <see cref="VaultsViewModel"/>.
+    /// </remarks>
+    Vaults = 3,
 
     /// <summary>Preferences.</summary>
     Preferences = 4,
@@ -275,7 +286,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// </remarks>
     private readonly ConnectionRecorder connectionLog;
 
-    private readonly TeamsViewModel teams;
+    private readonly VaultsViewModel vaults;
 
     /// <summary>
     /// The tab standing in for each connection that has been asked for and has not answered yet.
@@ -381,7 +392,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         // The third argument is how a vault made over there reaches the lists and the menu over here: both
         // are built from the session's vault list, and neither would otherwise learn that it had grown until
         // something else happened to rebuild them.
-        teams = new TeamsViewModel(() => connection, () => Vault?.Session, OnVaultsChangedAsync);
+        vaults = new VaultsViewModel(() => connection, () => Vault?.Session, OnVaultsChangedAsync);
 
         // Subscribed for the life of the process, because the workspace lives that long and so does the tab
         // list. Detached in DisposeAsync, which is the only point either of them ends.
@@ -532,15 +543,19 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     private LogsViewModel? logsScreen;
 
     /// <summary>
-    /// The teams screen, which the window binds to whether or not a vault is open.
+    /// The vaults screen, which the window binds to whether or not a vault is open.
     /// </summary>
     /// <remarks>
-    /// Not nullable and never replaced, for the reason <see cref="Transfers"/> is not: the screen reads a
-    /// server rather than a vault, and both of its dependencies are fetched through a function at the
-    /// moment they are needed. That means a lock does not have to tear it down and an unlock does not have
-    /// to rebuild it, and the list it is showing survives both.
+    /// Not nullable and never replaced, for the reason <see cref="Transfers"/> is not: both of its
+    /// dependencies are fetched through a function at the moment they are needed. That means a lock does
+    /// not have to tear it down and an unlock does not have to rebuild it, and the list it is showing
+    /// survives both.
+    /// <para>
+    /// Distinct from <see cref="Vault"/>, which is one vault's <em>contents</em> — the hosts, keys and
+    /// passwords the rail's other screens draw. This one is the vaults themselves and the people in them.
+    /// </para>
     /// </remarks>
-    internal TeamsViewModel Teams => teams;
+    internal VaultsViewModel Vaults => vaults;
 
     /// <summary>The transfers screen, which the window binds to whether or not a vault is open.</summary>
     /// <remarks>
@@ -759,10 +774,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal bool IsTransfersScreen => Screen is ShellScreen.Transfers;
 
     /// <inheritdoc cref="IsHostsScreen" />
-    internal bool IsVaultScreen => Screen is ShellScreen.Vault;
+    internal bool IsKeychainScreen => Screen is ShellScreen.Keychain;
 
     /// <inheritdoc cref="IsHostsScreen" />
-    internal bool IsTeamScreen => Screen is ShellScreen.Team;
+    internal bool IsVaultsScreen => Screen is ShellScreen.Vaults;
 
     /// <inheritdoc cref="IsHostsScreen" />
     internal bool IsPreferencesScreen => Screen is ShellScreen.Preferences;
@@ -801,10 +816,10 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal bool IsTransfersShowing => IsShowingPages && IsTransfersScreen;
 
     /// <inheritdoc cref="IsHostsShowing" />
-    internal bool IsVaultShowing => IsShowingPages && IsVaultScreen;
+    internal bool IsKeychainShowing => IsShowingPages && IsKeychainScreen;
 
     /// <inheritdoc cref="IsHostsShowing" />
-    internal bool IsTeamShowing => IsShowingPages && IsTeamScreen;
+    internal bool IsVaultsShowing => IsShowingPages && IsVaultsScreen;
 
     /// <inheritdoc cref="IsHostsShowing" />
     internal bool IsPreferencesShowing => IsShowingPages && IsPreferencesScreen;
@@ -834,8 +849,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// tabs are each exactly one thing, and this one is seven.
     ///
     /// Preferences is in the list because the phone reaches it through the hub. The desktop reaches it from
-    /// the rail and never asks this. <see cref="ShellScreen.Team"/> is in it for the same reason and no
-    /// other: the desktop has a rail entry for teams and the phone reaches them through the hub, so a
+    /// the rail and never asks this. <see cref="ShellScreen.Vaults"/> is in it for the same reason and no
+    /// other: the desktop has a rail entry for it and the phone reaches it through the hub, so a
     /// screen missing here is one whose arrival darkens the tab that led to it and brings the shell's own
     /// header back over a screen that already has one.
     ///
@@ -849,7 +864,7 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     internal bool IsMoreSurface =>
         IsShowingPages && Screen is ShellScreen.More or ShellScreen.Snippets or ShellScreen.Logs
             or ShellScreen.Transfers or ShellScreen.Buckets or ShellScreen.Preferences
-            or ShellScreen.Team or ShellScreen.Vault;
+            or ShellScreen.Vaults or ShellScreen.Keychain;
 
     /// <summary>
     /// Whether the terminal's WebView may be on screen at this instant.
@@ -1107,6 +1122,11 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     /// and the two would have had to be kept in step. <see cref="IsTransfersShowing"/> and
     /// <see cref="IsBucketsShowing"/> are the other two tabs, unchanged and already used by both heads.
     /// </para>
+    /// <para>
+    /// <b>Not <see cref="IsVaultsShowing"/>, which is one of the nine screens underneath this tab.</b> The
+    /// two are true together whenever somebody is looking at the vaults screen and are otherwise unrelated:
+    /// this one is "the strip is on its first tab rather than on SFTP, S3 or a terminal".
+    /// </para>
     /// </remarks>
     internal bool IsVaultsTab => IsShowingPages && IsVaultsPage(Screen);
 
@@ -1265,19 +1285,19 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     }
 
     /// <summary>
-    /// Goes to the teams screen with the new-vault form open.
+    /// Goes to the vaults screen with the new-vault form open.
     /// </summary>
     /// <remarks>
-    /// A vault gets a team, so the place to make one is the screen that shows teams — where the people, the
-    /// roles and the key holders already are, which is the next thing anybody making a shared vault wants.
-    /// The form asks for a name and nothing else; see <c>TeamsViewModel.CreateVaultAsync</c> for what is
+    /// The screen a vault is made on is the one that shows vaults — where the people, the roles and the key
+    /// holders already are, which is the next thing anybody making a shared vault wants. The form asks for a
+    /// name and nothing else; see <c>VaultsViewModel.CreateVaultAsync</c> for the membership list that is
     /// made behind it.
     /// </remarks>
     [RelayCommand]
     private void ShowNewVault()
     {
-        ShowScreen(ShellScreen.Team);
-        teams.NewVaultInItsOwnTeamCommand.Execute(null);
+        ShowScreen(ShellScreen.Vaults);
+        vaults.NewVaultCommand.Execute(null);
     }
 
     // ---- The phone's connect menu ----
@@ -2964,13 +2984,14 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
             _ = logs.RefreshCommand.ExecuteAsync(null);
         }
 
-        // Teams are read from the server rather than from the vault, so there is nothing to show until
-        // somebody asks for it — and asking for it on every unlock would be a request per launch for a
-        // screen most people never open. Fire-and-forget because a property change cannot await, and
-        // because the view model turns every failure into its own status line rather than throwing.
-        if (value is ShellScreen.Team)
+        // Who is in each vault is read from the server rather than from the vault itself, so there is
+        // nothing to show until somebody asks for it — and asking for it on every unlock would be a request
+        // per launch for a screen most people never open. Fire-and-forget because a property change cannot
+        // await, and because the view model turns every failure into its own status line rather than
+        // throwing.
+        if (value is ShellScreen.Vaults)
         {
-            _ = teams.LoadAsync(CancellationToken.None);
+            _ = vaults.LoadAsync(CancellationToken.None);
         }
 
     }
@@ -3044,8 +3065,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
     {
         OnPropertyChanged(nameof(IsHostsScreen));
         OnPropertyChanged(nameof(IsTransfersScreen));
-        OnPropertyChanged(nameof(IsVaultScreen));
-        OnPropertyChanged(nameof(IsTeamScreen));
+        OnPropertyChanged(nameof(IsKeychainScreen));
+        OnPropertyChanged(nameof(IsVaultsScreen));
         OnPropertyChanged(nameof(IsPreferencesScreen));
         OnPropertyChanged(nameof(IsKnownHostsScreen));
         OnPropertyChanged(nameof(IsImportScreen));
@@ -3058,8 +3079,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
         OnPropertyChanged(nameof(IsVaultsTab));
         OnPropertyChanged(nameof(IsHostsShowing));
         OnPropertyChanged(nameof(IsTransfersShowing));
-        OnPropertyChanged(nameof(IsVaultShowing));
-        OnPropertyChanged(nameof(IsTeamShowing));
+        OnPropertyChanged(nameof(IsKeychainShowing));
+        OnPropertyChanged(nameof(IsVaultsShowing));
         OnPropertyChanged(nameof(IsPreferencesShowing));
         OnPropertyChanged(nameof(IsKnownHostsShowing));
         OnPropertyChanged(nameof(IsSnippetsShowing));

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

@@ -864,11 +864,12 @@ internal sealed record VaultChoiceViewModel(Guid VaultId, string Name, bool IsPe
     /// What the picker shows.
     /// </summary>
     /// <remarks>
-    /// A team vault is marked as one. The whole risk this picker introduces is putting a credential
+    /// A shared vault is marked as one. The whole risk this picker introduces is putting a credential
     /// somewhere more people can read it, so the option that does that must not look like the option
-    /// that does not.
+    /// that does not. It says SHARED rather than TEAM because a team is no longer something the person
+    /// choosing has been shown — see <c>VaultsViewModel</c>.
     /// </remarks>
-    internal string Display => IsPersonal ? Name : $"{Name} · TEAM";
+    internal string Display => IsPersonal ? Name : $"{Name} · SHARED";
 }
 
 internal sealed record VaultItemRowViewModel(
@@ -1064,6 +1065,18 @@ internal sealed partial class VaultViewModel(
     /// </remarks>
     private Dictionary<Guid, HostGroupSecret> groupsById = [];
 
+    /// <summary>
+    /// Every readable vault's groups, kept apart by the vault they live in.
+    /// </summary>
+    /// <remarks>
+    /// What the host editor's group picker is built from, and it has to be per vault rather than the one
+    /// list <see cref="Groups"/> holds. A group is an item like any other, so it lives in exactly one
+    /// vault; offering the personal vault's groups while a host is being filed into a shared one would
+    /// produce a host whose group id nobody else in that vault can resolve — a colleague would see it
+    /// filed under nothing, which is the quietest kind of wrong. See <see cref="BuildGroupChoices"/>.
+    /// </remarks>
+    private Dictionary<Guid, List<GroupChoice>> groupsByVault = [];
+
     /// <summary>
     /// The tags as they came out of the vault, before the host counts are attached.
     /// </summary>
@@ -1916,10 +1929,50 @@ internal sealed partial class VaultViewModel(
     [ObservableProperty]
     private AuthenticationChoice? editorSelectedAuthentication;
 
-    /// <summary>What the group picker offers: "no group", then every group.</summary>
+    /// <summary>What the group picker offers: "no group", then every group of the chosen vault.</summary>
     /// <inheritdoc cref="EditorAuthenticationChoices" path="/remarks" />
     internal ObservableCollection<GroupChoice> EditorGroupChoices { get; } = [];
 
+    /// <summary>
+    /// Which vault a host being created will be filed into.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The picker in the host editor itself, and it is a second one rather than the keychain screen's
+    /// <see cref="TargetVaults"/> reused: that one is a standing preference about where new items go and
+    /// this is a field of the host in front of you. Binding both to one selection would mean the box under
+    /// SSH KEYS moved every time somebody put a host somewhere, and — the other way round — that a host
+    /// half-typed on this screen could be moved by a click on that one, which is the bug
+    /// <see cref="editingHostVaultId"/> was introduced to prevent.
+    /// </para>
+    /// <para>
+    /// Filled from the same source, so what it offers is what the keychain screen offers: vaults this
+    /// session can both read and write.
+    /// </para>
+    /// </remarks>
+    internal ObservableCollection<VaultChoiceViewModel> EditorVaultChoices { get; } = [];
+
+    [ObservableProperty]
+    private VaultChoiceViewModel? editorSelectedVault;
+
+    /// <summary>
+    /// Whether the editor should be asking which vault this host goes into.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Only while creating, and only where there is more than one vault to choose between. An existing
+    /// host's vault is not editable and the picker is not shown disabled beside it: the two are encrypted
+    /// under different keys, so moving an item is a delete and a retype rather than a save — see the note
+    /// on the drawer's header, which says where the host is filed.
+    /// </para>
+    /// <para>
+    /// Hidden at one vault rather than shown with a single option, which is the rule
+    /// <see cref="HasVaultChoice"/> already applies for the same reason: a control offering one answer is
+    /// a question nobody was asked.
+    /// </para>
+    /// </remarks>
+    internal bool ShowsEditorVaultChoice => editingEntityId is null && EditorVaultChoices.Count > 1;
+
     [ObservableProperty]
     [NotifyPropertyChangedFor(nameof(EditorPortPlaceholder))]
     [NotifyPropertyChangedFor(nameof(EditorUsernamePlaceholder))]
@@ -2990,6 +3043,8 @@ internal sealed partial class VaultViewModel(
         // still this one's.
         groupItems = [];
 
+        var perVault = new Dictionary<Guid, List<GroupChoice>>();
+
         foreach (var vault in session.ReadableVaults)
         {
             var listing = await session.HostGroups
@@ -3003,6 +3058,13 @@ internal sealed partial class VaultViewModel(
                 resolvable[group.EntityId] = group.Secret;
             }
 
+            perVault[vault.VaultId] =
+            [
+                .. listing.Items
+                    .OrderBy(group => group.Secret.Label, StringComparer.CurrentCulture)
+                    .Select(group => new GroupChoice(group.EntityId, group.Secret.Label)),
+            ];
+
             if (vault.VaultId == session.ActiveVaultId)
             {
                 groupItems =
@@ -3011,6 +3073,7 @@ internal sealed partial class VaultViewModel(
         }
 
         groupsById = resolvable;
+        groupsByVault = perVault;
 
         return unreadable;
     }
@@ -4118,7 +4181,12 @@ internal sealed partial class VaultViewModel(
         }
 
         editingEntityId = null;
+
+        // The keychain screen's picker is the default rather than the answer: the editor has a picker of its
+        // own from here on, and moving that one is what decides where this host lands. See
+        // EditorVaultChoices.
         editingHostVaultId = TargetVaultId;
+
         EditorLabel = string.Empty;
         EditorHostname = string.Empty;
 
@@ -4132,13 +4200,18 @@ internal sealed partial class VaultViewModel(
         EditorNewTag = string.Empty;
         BuildTagChoices();
 
+        // Before the group picker, because a group belongs to one vault and the picker is that vault's.
+        BuildEditorVaultChoices(editingHostVaultId);
+
         // A new host opens in the group the screen is already about — the card that is selected, or failing
         // that the group whose contents are showing. Adding three machines to the group somebody has just
         // made is the ordinary case, and since the grid holds one level at a time the alternative is worse
         // than a default nobody chose: a host created inside a group and filed under none would vanish from
-        // the screen it was created on. Before the picker, because whether there is a group to inherit from
-        // decides whether the picker offers to.
-        BuildGroupChoices(GroupTarget?.EntityId);
+        // the screen it was created on. Only when that group is in the vault this host is going into,
+        // though — the grid draws the active vault's groups, and inheriting one into a shared vault would
+        // file the host under something nobody else in it can resolve. Before the authentication picker,
+        // because whether there is a group to inherit from decides whether that one offers to.
+        BuildGroupChoices(GroupInEditingVault(GroupTarget?.EntityId));
 
         BuildAuthenticationChoices(
             boundKeyId: null,
@@ -4167,7 +4240,13 @@ internal sealed partial class VaultViewModel(
         }
 
         editingEntityId = row.EntityId;
+
+        // The host's own vault, and it does not move: the two are encrypted under different keys, so
+        // saving anywhere else would fork it rather than move it. The picker is hidden for an existing
+        // host — see ShowsEditorVaultChoice — and is filled anyway so that it is not showing the last
+        // host's vault behind the panel.
         editingHostVaultId = row.VaultId;
+
         EditorLabel = row.Host.Label;
         EditorHostname = row.Host.Hostname;
 
@@ -4182,6 +4261,7 @@ internal sealed partial class VaultViewModel(
         EditorNewTag = string.Empty;
         BuildTagChoices();
 
+        BuildEditorVaultChoices(editingHostVaultId);
         BuildGroupChoices(row.Host.GroupId);
 
         BuildAuthenticationChoices(
@@ -6873,14 +6953,98 @@ internal sealed partial class VaultViewModel(
     /// somebody editing the host's port would unfile it by saving. It says the group is gone rather than
     /// naming it, because there is nothing left to read the name off.
     /// </remarks>
+    /// <summary>Refills the host editor's vault picker, landing on the vault the editor will write to.</summary>
+    /// <remarks>
+    /// Filled from <see cref="TargetVaults"/>, which is already the readable-and-writable set and is kept
+    /// in step with the session by <see cref="RebuildTargetVaults"/>. The options are shared objects rather
+    /// than copies, so the two pickers show the same names without either one being able to move the other:
+    /// what they do not share is the selection.
+    /// </remarks>
+    private void BuildEditorVaultChoices(Guid vaultId)
+    {
+        EditorVaultChoices.Clear();
+
+        foreach (var choice in TargetVaults)
+        {
+            EditorVaultChoices.Add(choice);
+        }
+
+        // Null where the host's vault is one this session cannot write — a team vault this account is a
+        // viewer of. The picker is hidden for an existing host anyway, and leaving the box empty is a
+        // better answer than adding an option that would move the host if it were touched.
+        EditorSelectedVault = EditorVaultChoices.FirstOrDefault(choice => choice.VaultId == vaultId);
+
+        OnPropertyChanged(nameof(ShowsEditorVaultChoice));
+    }
+
+    /// <summary>
+    /// Moves a half-typed host into the vault just chosen for it.
+    /// </summary>
+    /// <remarks>
+    /// Only while creating. An existing host's vault is fixed, and this guard is what makes that true
+    /// rather than the view merely not drawing the control: an item cannot be moved between vaults, so a
+    /// path that reassigned this on an edit would write the host into a second vault and leave the
+    /// original behind.
+    /// </remarks>
+    partial void OnEditorSelectedVaultChanged(VaultChoiceViewModel? value)
+    {
+        if (value is null || editingEntityId is not null || editingHostVaultId == value.VaultId)
+        {
+            return;
+        }
+
+        editingHostVaultId = value.VaultId;
+
+        var authentication = EditorSelectedAuthentication;
+
+        // The group picker is the vault's, so it has to be rebuilt — and whatever was chosen in it belongs
+        // to the vault just left, so it is kept only if the new one has it too. Which in practice means it
+        // is dropped, because a group is one item in one vault.
+        BuildGroupChoices(GroupInEditingVault(EditorSelectedGroup?.EntityId));
+
+        // Rebuilt after it, because "inherit from group" is offered only to a host that is in one — and
+        // whether this one still is has just been decided above. The key and credential entries are not
+        // filtered by vault, unlike the groups: the key list spans every readable vault by design, and a
+        // host authenticating with a key from another vault is a thing this application already supports.
+        BuildAuthenticationChoices(
+            authentication?.Kind == AuthenticationKind.SshKey ? authentication.EntityId : null,
+            authentication?.Kind == AuthenticationKind.Credential ? authentication.EntityId : null,
+            asksForPassword: authentication?.Kind == AuthenticationKind.Typed,
+            grouped: EditorSelectedGroup?.EntityId is not null);
+    }
+
+    /// <summary>The group, if the vault being written to actually has it; otherwise none.</summary>
+    private Guid? GroupInEditingVault(Guid? groupId) =>
+        groupId is { } id
+            && groupsByVault.TryGetValue(editingHostVaultId, out var groups)
+            && groups.Any(choice => choice.EntityId == id)
+                ? id
+                : null;
+
+    /// <summary>Refills the host editor's group picker for one vault.</summary>
+    /// <param name="groupId">The group to land on, or null for none.</param>
+    /// <remarks>
+    /// <para>
+    /// The vault's own groups and no others — see <see cref="groupsByVault"/>. A vault this session cannot
+    /// read has no entry there and gets an empty list rather than the active vault's, which is the right
+    /// answer for a picker: there is nothing in it that this host could be filed under.
+    /// </para>
+    /// <para>
+    /// A group the vault no longer has keeps a placeholder entry, so that editing a host's port cannot
+    /// quietly unfile it.
+    /// </para>
+    /// </remarks>
     private void BuildGroupChoices(Guid? groupId)
     {
         EditorGroupChoices.Clear();
         EditorGroupChoices.Add(GroupChoice.None);
 
-        foreach (var group in Groups)
+        if (groupsByVault.TryGetValue(editingHostVaultId, out var groups))
         {
-            EditorGroupChoices.Add(new GroupChoice(group.EntityId, group.Label));
+            foreach (var group in groups)
+            {
+                EditorGroupChoices.Add(group);
+            }
         }
 
         if (groupId is { } bound && !EditorGroupChoices.Any(choice => choice.EntityId == bound))

src/DodoSSH.Contracts/DodoSshJsonContext.cs

@@ -53,6 +53,7 @@ namespace DodoSSH.Contracts;
 [JsonSerializable(typeof(TeamInvitationSummary))]
 [JsonSerializable(typeof(IReadOnlyList<TeamInvitationSummary>))]
 [JsonSerializable(typeof(CreateTeamVaultRequest))]
+[JsonSerializable(typeof(UpdateVaultRequest))]
 [JsonSerializable(typeof(IssueVaultGrantRequest))]
 [JsonSerializable(typeof(VaultGrantsResponse))]
 [JsonSerializable(typeof(KeyLogPage))]

src/DodoSSH.Contracts/PublicAPI.Unshipped.txt

@@ -666,6 +666,13 @@ DodoSSH.Contracts.UpdateTeamRequest.Equals(DodoSSH.Contracts.UpdateTeamRequest?
 DodoSSH.Contracts.UpdateTeamRequest.Name.get -> string!
 DodoSSH.Contracts.UpdateTeamRequest.Name.init -> void
 DodoSSH.Contracts.UpdateTeamRequest.UpdateTeamRequest(string! Name, string? Description) -> void
+DodoSSH.Contracts.UpdateVaultRequest
+DodoSSH.Contracts.UpdateVaultRequest.<Clone>$() -> DodoSSH.Contracts.UpdateVaultRequest!
+DodoSSH.Contracts.UpdateVaultRequest.Deconstruct(out string! Name) -> void
+DodoSSH.Contracts.UpdateVaultRequest.Equals(DodoSSH.Contracts.UpdateVaultRequest? other) -> bool
+DodoSSH.Contracts.UpdateVaultRequest.Name.get -> string!
+DodoSSH.Contracts.UpdateVaultRequest.Name.init -> void
+DodoSSH.Contracts.UpdateVaultRequest.UpdateVaultRequest(string! Name) -> void
 DodoSSH.Contracts.VaultGrantsResponse
 DodoSSH.Contracts.VaultGrantsResponse.<Clone>$() -> DodoSSH.Contracts.VaultGrantsResponse!
 DodoSSH.Contracts.VaultGrantsResponse.Deconstruct(out System.Guid VaultId, out uint KeyGeneration, out bool RekeyRequired, out System.Collections.Generic.IReadOnlyList<DodoSSH.Contracts.VaultGrantSummary!>! Grants) -> void
@@ -840,6 +847,9 @@ override DodoSSH.Contracts.TransferTeamOwnershipRequest.ToString() -> string!
 override DodoSSH.Contracts.UpdateTeamRequest.Equals(object? obj) -> bool
 override DodoSSH.Contracts.UpdateTeamRequest.GetHashCode() -> int
 override DodoSSH.Contracts.UpdateTeamRequest.ToString() -> string!
+override DodoSSH.Contracts.UpdateVaultRequest.Equals(object? obj) -> bool
+override DodoSSH.Contracts.UpdateVaultRequest.GetHashCode() -> int
+override DodoSSH.Contracts.UpdateVaultRequest.ToString() -> string!
 override DodoSSH.Contracts.VaultGrantsResponse.Equals(object? obj) -> bool
 override DodoSSH.Contracts.VaultGrantsResponse.GetHashCode() -> int
 override DodoSSH.Contracts.VaultGrantsResponse.ToString() -> string!
@@ -928,6 +938,8 @@ static DodoSSH.Contracts.TransferTeamOwnershipRequest.operator !=(DodoSSH.Contra
 static DodoSSH.Contracts.TransferTeamOwnershipRequest.operator ==(DodoSSH.Contracts.TransferTeamOwnershipRequest? left, DodoSSH.Contracts.TransferTeamOwnershipRequest? right) -> bool
 static DodoSSH.Contracts.UpdateTeamRequest.operator !=(DodoSSH.Contracts.UpdateTeamRequest? left, DodoSSH.Contracts.UpdateTeamRequest? right) -> bool
 static DodoSSH.Contracts.UpdateTeamRequest.operator ==(DodoSSH.Contracts.UpdateTeamRequest? left, DodoSSH.Contracts.UpdateTeamRequest? right) -> bool
+static DodoSSH.Contracts.UpdateVaultRequest.operator !=(DodoSSH.Contracts.UpdateVaultRequest? left, DodoSSH.Contracts.UpdateVaultRequest? right) -> bool
+static DodoSSH.Contracts.UpdateVaultRequest.operator ==(DodoSSH.Contracts.UpdateVaultRequest? left, DodoSSH.Contracts.UpdateVaultRequest? right) -> bool
 static DodoSSH.Contracts.VaultGrantsResponse.operator !=(DodoSSH.Contracts.VaultGrantsResponse? left, DodoSSH.Contracts.VaultGrantsResponse? right) -> bool
 static DodoSSH.Contracts.VaultGrantsResponse.operator ==(DodoSSH.Contracts.VaultGrantsResponse? left, DodoSSH.Contracts.VaultGrantsResponse? right) -> bool
 static DodoSSH.Contracts.VaultGrantSummary.operator !=(DodoSSH.Contracts.VaultGrantSummary? left, DodoSSH.Contracts.VaultGrantSummary? right) -> bool

src/DodoSSH.Contracts/Teams.cs

@@ -369,6 +369,27 @@ public sealed record CreateTeamVaultRequest(
     byte[] GrantSignature,
     DateTimeOffset GrantedAt);
 
+/// <summary>Renames a vault.</summary>
+/// <remarks>
+/// <para>
+/// The one field of a vault a person chose, and the only one that can be changed. A vault's key
+/// generation, its owner and its rekey flag are all consequences of something else happening; its name
+/// is what somebody typed into a box, and typing the wrong thing into a box is the ordinary mistake this
+/// exists to undo.
+/// </para>
+/// <para>
+/// It is plaintext, as vault names have always been — a person has to be able to choose a vault before
+/// anything is decrypted (<c>docs/crypto.md</c> §10). So a rename is visible to the operator, exactly as
+/// the original name was, and this changes nothing about what the server can read.
+/// </para>
+/// <para>
+/// A whole replacement rather than a patch, for the reason <see cref="UpdateTeamRequest"/> is one: there
+/// is a single field, so a repeat is the same vault rather than a second edit.
+/// </para>
+/// </remarks>
+/// <param name="Name">Display name. Required, 1 to 256 characters.</param>
+public sealed record UpdateVaultRequest(string Name);
+
 /// <summary>Issues a vault key grant to another member.</summary>
 /// <remarks>
 /// <para>